date:20200813

2020-08-13 Thread Longpeng (Mike, Cloud Infrastructure Service Product Dept.)

Patchew URL: 
https://patchew.org/QEMU/20200814035819.1214-1-jiangyi...@huawei.com/



Hi,

This series failed the docker-quick@centos7 build test. Please find the testing 
commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
make docker-image-centos7 V=1 NETWORK=1
time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
=== TEST SCRIPT END ===

  TESTcheck-unit: tests/test-char
Unexpected error in object_property_try_add() at 
/tmp/qemu-test/src/qom/object.c:1181:
attempt to add duplicate property 'serial-id' to object (type 'container')
ERROR test-char - too few tests run (expected 38, got 9)
make: *** [check-unit] Error 1
make: *** Waiting for unfinished jobs
  TESTiotest-qcow2: 029
  TESTcheck-qtest-x86_64: tests/qtest/hd-geo-test
---
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['sudo', '-n', 'docker', 'run', 
'--label', 'com.qemu.instance.uuid=83e8be982fe84f739b342435f33b62f6', '-u', 
'1003', '--security-opt', 'seccomp=unconfined', '--rm', '-e', 'TARGET_LIST=', 
'-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=14', '-e', 'DEBUG=', '-e', 
'SHOW_ENV=1', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', 
'/home/patchew2/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', 
'/var/tmp/patchew-tester-tmp-brxkol53/src/docker-src.2020-08-14-00.10.36.6152:/var/tmp/qemu:z,ro',
 'qemu/centos7', '/var/tmp/qemu/run', 'test-quick']' returned non-zero exit 
status 2.
filter=--filter=label=com.qemu.instance.uuid=83e8be982fe84f739b342435f33b62f6
make[1]: *** [docker-run] Error 1
make[1]: Leaving directory `/var/tmp/patchew-tester-tmp-brxkol53/src'
make: *** [docker-run-test-quick@centos7] Error 2

real13m15.058s
user0m8.409s


The full log is available at
http://patchew.org/logs/20200814035819.1214-1-jiangyi...@huawei.com/testing.docker-quick@centos7/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

Re: [PATCH v2] nvram: Exit QEMU if NVRAM cannot contain all -prom-env data

2020-08-13 Thread David Gibson

On Fri, Aug 14, 2020 at 01:12:19AM +0200, Greg Kurz wrote:
> Since commit 61f20b9dc5b7 ("spapr_nvram: Pre-initialize the NVRAM to
> support the -prom-env parameter"), pseries machines can pre-initialize
> the "system" partition in the NVRAM with the data passed to all -prom-env
> parameters on the QEMU command line.
> 
> In this case it is assumed that all the data fits in 64 KiB, but the user
> can easily pass more and crash QEMU:
> 
> $ qemu-system-ppc64 -M pseries $(for ((x=0;x<128;x++)); do \
>   echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
>   done) # this requires ~128 Kib
> malloc(): corrupted top size
> Aborted (core dumped)
> 
> This happens because we don't check if all the prom-env data fits in
> the NVRAM and chrp_nvram_set_var() happily memcpy() it passed the
> buffer.
> 
> This crash affects basically all ppc/ppc64 machine types that use -prom-env:
> - pseries (all versions)
> - g3beige
> - mac99
> 
> and also sparc/sparc64 machine types:
> - LX
> - SPARCClassic
> - SPARCbook
> - SS-10
> - SS-20
> - SS-4
> - SS-5
> - SS-600MP
> - Voyager
> - sun4u
> - sun4v
> 
> Add a max_len argument to chrp_nvram_create_system_partition() so that
> it can check the available size before writing to memory.
> 
> Since NVRAM is populated at machine init, it seems reasonable to consider
> this error as fatal. So, instead of reporting an error when we detect that
> the NVRAM is too small and adapt all machine types to handle it, we simply
> exit QEMU in all cases. This is still better than crashing. If someone
> wants another behavior, I guess this can be reworked later.
> 
> Tested with:
> 
> $ yes q | \
>   (for arch in ppc ppc64 sparc sparc64; do \
>echo == $arch ==; \
>qemu=${arch}-softmmu/qemu-system-$arch; \
>for mach in $($qemu -M help | awk '! /^Supported/ { print $1 }'); do \
>echo $mach; \
>$qemu -M $mach -monitor stdio -nodefaults -nographic \
>$(for ((x=0;x<128;x++)); do \
>  echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
>  done) >/dev/null; \
> done; echo; \
>done)
> 
> Without the patch, affected machine types cause QEMU to report some
> memory corruption and crash:
> 
> malloc(): corrupted top size
> 
> free(): invalid size
> 
> *** stack smashing detected ***: terminated
> 
> With the patch, QEMU prints the following message and exits:
> 
> NVRAM is too small. Try to pass less data to -prom-env
> 
> It seems that the conditions for the crash have always existed, but it
> affects pseries, the machine type I care for, since commit 61f20b9dc5b7
> only.
> 
> Fixes: 61f20b9dc5b7 ("spapr_nvram: Pre-initialize the NVRAM to support the 
> -prom-env parameter")
> RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1867739
> Reported-by: John Snow 
> Reviewed-by: Laurent Vivier 
> Signed-off-by: Greg Kurz 

Applied to ppc-for-5.2, thanks.

> ---
> v2: - fixed system partition size for sparc/sparc64 (Laurent)
> ---
>  hw/nvram/chrp_nvram.c |   24 +---
>  hw/nvram/mac_nvram.c  |2 +-
>  hw/nvram/spapr_nvram.c|3 ++-
>  hw/sparc/sun4m.c  |2 +-
>  hw/sparc64/sun4u.c|2 +-
>  include/hw/nvram/chrp_nvram.h |3 ++-
>  6 files changed, 28 insertions(+), 8 deletions(-)
> 
> diff --git a/hw/nvram/chrp_nvram.c b/hw/nvram/chrp_nvram.c
> index d969f267048e..d4d10a7c03c7 100644
> --- a/hw/nvram/chrp_nvram.c
> +++ b/hw/nvram/chrp_nvram.c
> @@ -21,14 +21,21 @@
>  
>  #include "qemu/osdep.h"
>  #include "qemu/cutils.h"
> +#include "qemu/error-report.h"
>  #include "hw/nvram/chrp_nvram.h"
>  #include "sysemu/sysemu.h"
>  
> -static int chrp_nvram_set_var(uint8_t *nvram, int addr, const char *str)
> +static int chrp_nvram_set_var(uint8_t *nvram, int addr, const char *str,
> +  int max_len)
>  {
>  int len;
>  
>  len = strlen(str) + 1;
> +
> +if (max_len < len) {
> +return -1;
> +}
> +
>  memcpy([addr], str, len);
>  
>  return addr + len;
> @@ -38,19 +45,26 @@ static int chrp_nvram_set_var(uint8_t *nvram, int addr, 
> const char *str)
>   * Create a "system partition", used for the Open Firmware
>   * environment variables.
>   */
> -int chrp_nvram_create_system_partition(uint8_t *data, int min_len)
> +int chrp_nvram_create_system_partition(uint8_t *data, int min_len, int 
> max_len)
>  {
>  ChrpNvramPartHdr *part_header;
>  unsigned int i;
>  int end;
>  
> +if (max_len < sizeof(*part_header)) {
> +goto fail;
> +}
> +
>  part_header = (ChrpNvramPartHdr *)data;
>  part_header->signature = CHRP_NVPART_SYSTEM;
>  pstrcpy(part_header->name, sizeof(part_header->name), "system");
>  
>  end = sizeof(ChrpNvramPartHdr);
>  for (i = 0; i < nb_prom_envs; i++) {
> -end = chrp_nvram_set_var(data, end, prom_envs[i]);
> +end = chrp_nvram_set_var(data, end, prom_envs[i], max_len - end);
> +if (end == -1) {
> +

Re: [PATCH] spapr/xive: Use xive_source_esb_len()

2020-08-13 Thread David Gibson

On Thu, Aug 13, 2020 at 05:38:59PM -0300, Gustavo Romero wrote:
> Hi Greg,
> 
> On 8/13/20 2:28 PM, Greg Kurz wrote:
> > static inline size_t xive_source_esb_len(XiveSource *xsrc)
> > {
> >  return (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
> > }
> > 
> > Signed-off-by: Greg Kurz 
> > ---
> > Follow-up on "ppc/xive: Rework setup of XiveSource::esb_mmio"
> > http://patchwork.ozlabs.org/project/qemu-devel/patch/159679992680.876294.7520540158586170894.st...@bahia.lan/
> > ---
> >   hw/intc/spapr_xive.c |2 +-
> >   hw/intc/spapr_xive_kvm.c |2 +-
> >   2 files changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
> > index 3c84f64dc464..4bd0d606ba17 100644
> > --- a/hw/intc/spapr_xive.c
> > +++ b/hw/intc/spapr_xive.c
> > @@ -336,7 +336,7 @@ static void spapr_xive_realize(DeviceState *dev, Error 
> > **errp)
> >   sysbus_init_mmio(SYS_BUS_DEVICE(xive), _xsrc->esb_mmio);
> >   /* Set the mapping address of the END ESB pages after the source ESBs 
> > */
> > -xive->end_base = xive->vc_base + (1ull << xsrc->esb_shift) * 
> > xsrc->nr_irqs;
> > +xive->end_base = xive->vc_base + xive_source_esb_len(xsrc);
> >   /*
> >* Allocate the routing tables
> > diff --git a/hw/intc/spapr_xive_kvm.c b/hw/intc/spapr_xive_kvm.c
> > index 82a6f99f022d..3263b982239a 100644
> > --- a/hw/intc/spapr_xive_kvm.c
> > +++ b/hw/intc/spapr_xive_kvm.c
> > @@ -831,7 +831,7 @@ void kvmppc_xive_disconnect(SpaprInterruptController 
> > *intc)
> >   /* Clear the KVM mapping */
> >   xsrc = >source;
> > -esb_len = (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
> > +esb_len = xive_source_esb_len(xsrc);
> 
> hrm I'd like to not add another level of indirection here.
> In this specific case I think it's more clear to read just
> 
> 1ull << xsrc->esb_shift) * xsrc->nr_irqs
> 
> and get the idea of one IRQ per ESB page (or pair of pages,
> for trigger and management), than one having to look at
> what is inside "a box" called xive_source_esb_len().
> 
> Wrapping it under another function doesn't help more when
> reading the code, XIVE is already tricky enough :)

Given that we're already using it in some places, I'd prefer to use it
in all the places that it's correct to do so.

Applied to ppc-for-5.2.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

Re: [PATCH 01/14] spapr: Simplify error handling in spapr_phb_realize()

2020-08-13 Thread David Gibson

On Thu, Aug 13, 2020 at 11:39:27PM +0200, Greg Kurz wrote:
> On Thu, 13 Aug 2020 16:57:04 -0300
> Daniel Henrique Barboza  wrote:
> 
> > Greg,
> > 
> > This patch is breaking guest startup in ppc-for-5.2 for me. The process
> > gives an almost instant segfault. Here's what I'm doing:
> > 
> 
> Ok, this is because this patch should have been applied after
> the "spapr: Cleanups for XIVE" series:
> 
> http://patchwork.ozlabs.org/project/qemu-devel/cover/159679991916.876294.8967140647442842745.st...@bahia.lan/
> 
> specifically this patch:
> 
> http://patchwork.ozlabs.org/project/qemu-devel/patch/159679993438.876294.7285654331498605426.st...@bahia.lan/
> 
> which prevents of a bogus error path in kvmppc_xive_source_reset_one() to
> be taken:

Oops, yeah,  I realized this halfway through and fixed it up, but
forgot to push out the updated version.

> 
> /* The KVM XIVE device is not in use */
> if (xive->fd == -1) {
> return -ENODEV; <== this should return 0 to avoid the segfault, but
> the real issue is that kvmppc_xive_*() calls
> shouldn't be called at all when we don't have
> a KVM XIVE device. This is the purpose of the
> "spapr: Cleanups for XIVE" series.
> }
> 
> I should maybe have added some Based-on: tag to make it clearer...

That would have helped, yes.

> 
> David,
> 
> Can you apply the series the other way around ?
> 
> First :
> 
> "spapr: Cleanups for XIVE"
> 
> http://patchwork.ozlabs.org/project/qemu-devel/cover/159679991916.876294.8967140647442842745.st...@bahia.lan/
> 
> Then :
> 
> "ppc/spapr: Error handling fixes and cleanups"
> 
> http://patchwork.ozlabs.org/project/qemu-devel/cover/159707843034.1489912.1082061742626355958.st...@bahia.lan/
> 
> Sorry everyone for the inconvenience.
> 

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: PGP signature

[PATCH] target/riscv: Fix bug in getting trap cause name for trace_riscv_trap

2020-08-13 Thread Yifei Jiang

When the cause number is equal to or greater than 23, print "(unknown)" in
trace_riscv_trap. The max valid number of riscv_excp_names is 23, so the last
excpetion "guest_store_page_fault" can not be printed.

In addition, the current check of cause is invalid for riscv_intr_names. So
introduce riscv_cpu_get_trap_name to get the trap cause name.

Signed-off-by: Yifei Jiang 
Signed-off-by: Yipeng Yin 
---
 target/riscv/cpu.c| 11 +++
 target/riscv/cpu.h|  1 +
 target/riscv/cpu_helper.c |  4 ++--
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 228b9bdb5d..bcdce85c5e 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -96,6 +96,17 @@ const char * const riscv_intr_names[] = {
 "reserved"
 };
 
+const char *riscv_cpu_get_trap_name(target_ulong cause, bool async)
+{
+if (async) {
+return (cause < ARRAY_SIZE(riscv_intr_names)) ?
+   riscv_intr_names[cause] : "(unknown)";
+} else {
+return (cause < ARRAY_SIZE(riscv_excp_names)) ?
+   riscv_excp_names[cause] : "(unknown)";
+}
+}
+
 static void set_misa(CPURISCVState *env, target_ulong misa)
 {
 env->misa_mask = env->misa = misa;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index a804a5d0ba..7c72979f6a 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -312,6 +312,7 @@ extern const char * const riscv_fpr_regnames[];
 extern const char * const riscv_excp_names[];
 extern const char * const riscv_intr_names[];
 
+const char *riscv_cpu_get_trap_name(target_ulong cause, bool async);
 void riscv_cpu_do_interrupt(CPUState *cpu);
 int riscv_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int riscv_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 75d2ae3434..2e047f0948 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -877,8 +877,8 @@ void riscv_cpu_do_interrupt(CPUState *cs)
 }
 }
 
-trace_riscv_trap(env->mhartid, async, cause, env->pc, tval, cause < 23 ?
-(async ? riscv_intr_names : riscv_excp_names)[cause] : "(unknown)");
+trace_riscv_trap(env->mhartid, async, cause, env->pc, tval,
+riscv_cpu_get_trap_name(cause, async));
 
 if (env->priv <= PRV_S &&
 cause < TARGET_LONG_BITS && ((deleg >> cause) & 1)) {
-- 
2.19.1

Re: [RFC v3 12/71] target/riscv: rvv-1.0: add fractional LMUL

2020-08-13 Thread Frank Chang

On Fri, Aug 7, 2020 at 2:36 AM Richard Henderson <
richard.hender...@linaro.org> wrote:

> On 8/6/20 3:46 AM, frank.ch...@sifive.com wrote:
> > +float flmul;
>
> int8_t?  It seems weird that the translator wouldn't also use...
>

It was kept for vector check functions.
However, I've removed float flmul and changed my
vector check functions to something like:

> static bool vext_check_sss(DisasContext *s, int vd, int vs1,
>int vs2, int vm, bool is_vs1)
> {
> bool ret = require_vm(vm, vd);
> if (s->lmul > 0) {
> ret &= require_align(vd, 1 << s->lmul) &&
>require_align(vs2, 1 << s->lmul);
> if (is_vs1) {
> ret &= require_align(vs1, 1 << s->lmul);
> }
> }
> return ret;
> }

which use shifts to check the alignment/noover of vector registers.

The parameters passed to require_align() and require_noover()
are also changed to const uint8_t type so that the shifted value can be
wrapped within 8-bits.

int8_t lmul in DisasContext is also encoded:
ctx->lmul = sextract32(FIELD_EX32(tb_flags, TB_FLAGS, LMUL), 0, 3);


> > +/*
> > + * Encode LMUL to lmul as following:
> > + * LMULvlmullmul
> > + *  1   000   0
> > + *  2   001   1
> > + *  4   010   2
> > + *  8   011   3
> > + *  -   100   -
> > + * 1/8  101  -3
> > + * 1/4  110  -2
> > + * 1/2  111  -1
> > + */
> > +static inline int32_t vext_lmul(uint32_t desc)
> >  {
> > -return FIELD_EX32(simd_data(desc), VDATA, LMUL);
> > +uint32_t lmul = FIELD_EX32(simd_data(desc), VDATA, LMUL);
> > +return (int8_t)(lmul << 5) >> 5;
> >  }
>
> ... this encoding?
>
> Oh, and sextract32(lmul, 0, 3) instead of those shifts.
>

OK~


>
>
> r~
>

Thanks
Frank Chang

Re: [RFC v3 26/71] target/riscv: rvv-1.0: update vext_max_elems() for load/store insns

2020-08-13 Thread Frank Chang

On Fri, Aug 7, 2020 at 8:04 AM Richard Henderson <
richard.hender...@linaro.org> wrote:

> On 8/6/20 3:46 AM, frank.ch...@sifive.com wrote:
> > +static inline uint32_t vext_max_elems(uint32_t desc, uint32_t esz, bool
> is_ldst)
> >  {
> > -return simd_maxsz(desc) << vext_lmul(desc);
> > +/*
> > + * As simd_desc support at most 256 bytes, the max vlen is 256 bits.
> > + * so vlen in bytes (vlenb) is encoded as maxsz.
> > + */
> > +uint32_t vlenb = simd_maxsz(desc);
> > +
> > +if (is_ldst) {
> > +/*
> > + * Vector load/store instructions have the EEW encoded
> > + * directly in the instructions. The maximum vector size is
> > + * calculated with EMUL rather than LMUL.
> > + */
> > +uint32_t eew = ctzl(esz);
> > +uint32_t sew = vext_sew(desc);
> > +uint32_t lmul = vext_lmul(desc);
> > +int32_t emul = eew - sew + lmul;
> > +uint32_t emul_r = emul < 0 ? 0 : emul;
> > +return 1 << (ctzl(vlenb) + emul_r - ctzl(esz));
>
> As I said before, the is_ldst instructions should put the EEW and EMUL
> values
> into the SEW and LMUL desc fields, so that this does not need to be

special-cased at all.
>

I add a vext_get_emul() helper function in trans_rvv.inc.c:

> static uint8_t vext_get_emul(DisasContext *s, uint8_t eew)
> {
> int8_t lmul = sextract32(s->lmul, 0, 3);
> int8_t emul = ctzl(eew) - (s->sew + 3) + lmul;  // may remove ctzl()
if eew is already log2(eew)
> return emul < 0 ? 0 : emul;
> }

and pass emul as LMUL field in VDATA so that it can be
reused in vector_helper.c: vext_max_elems():

> uint8_t emul = vext_get_emul(s, eew);
> data = FIELD_DP32(data, VDATA, LMUL, emul);

I also remove the passing SEW field in VDATA codes as I think SEW
might not be required in the updated vext_max_elems() (see below).


>
> > +/* Return VLMAX */
> > +return 1 << (ctzl(vlenb) + vext_lmul(desc) - ctzl(esz));
>
> This is overly complicated.
>
> (1) 1 << ctzl(vlenb) == vlenb.
> (2) I'm not sure why esz is not already a log2 number.
>

esz is passed from e.g. GEN_VEXT_LD_STRIDE() macro:

> #define GEN_VEXT_LD_STRIDE(NAME, ETYPE, LOAD_FN)\
> void HELPER(NAME)(void *vd, void * v0, target_ulong base,   \
>   target_ulong stride, CPURISCVState *env,
  \
>   uint32_t desc)
 \
> {
   \
> uint32_t vm = vext_vm(desc);
\
> vext_ldst_stride(vd, v0, base, stride, env, desc, vm, LOAD_FN, \
>  sizeof(ETYPE), GETPC(), MMU_DATA_LOAD);\
> }
>
> GEN_VEXT_LD_STRIDE(vlse8_v,  int8_t,  lde_b)

which is calculated by sizeof(ETYPE), so the results would be: 1, 2, 4, 8.
and vext_max_elems() is called by e.g. vext_ldst_stride():

> uint32_t max_elems = vext_max_elems(desc, esz);

I can add another parameter to the macro and pass the hard-coded log2(esz)
number
if it's the better way instead of using ctzl().
Or if there's another approach to get the log2(esz) number more elegantly?


>
> This ought to look more like
>
>   int scale = lmul - esz;
>   return (scale < 0
>   ? vlenb >> -scale
>   : vlenb << scale);
>
>
Thanks for the detailed point outs.
I manage to change the codes to below as your suggestion.

> static inline uint32_t vext_max_elems(uint32_t desc, uint32_t esz)
> {
> /*
>  * As simd_desc support at most 256 bytes, the max vlen is 256 bits.
>  * so vlen in bytes (vlenb) is encoded as maxsz.
>  */
> uint32_t vlenb = simd_maxsz(desc);
>
> /* Return VLMAX */
> int scale = vext_lmul(desc) - ctzl(esz);  // may remove ctzl() if esz
is already log2(esz)
> return scale < 0 ? vlenb >> -scale : vlenb << scale;
> }


>
> r~
>

Thanks for the review.
Frank Chang

Re: [PATCH 2/2] target/mips: Add definition of Loongson-3A3000 CPU

2020-08-13 Thread Jiaxun Yang





在 2020/8/14 上午10:43, Kaige Li 写道:

On 08/13/2020 06:37 PM, Jiaxun Yang wrote:




在 2020/8/13 下午5:41, Kaige Li 写道:

Add definition of the Loongson-3A3000 processor in QEMU.


Hi Kaige,

We're not defining Loongson-3A3000 in QEMU because we have
some features like Loongson-EXT2, VTLB not available currently, I'd
prefer define it after we add these features to TCG.

Loongson-3A4000's define is a exception to support KVM.

Ok, I see. This will be defined later, right?

Yes..

If you're willing to help I'd suggest you to take a look at how to implement
Loongson SPW (LDPTE LDDIR etc) in QEMU.


Thanks.

- Jiaxun



Thanks.
Kaige.


Thanks.

- Jiaxun

Re: [RFC PATCH v2 1/3] target/mips/op_helper: Convert multiple if() to switch case

2020-08-13 Thread Jiaxun Yang





在 2020/8/14 上午2:15, Philippe Mathieu-Daudé 写道:

The cache operation is encoded in bits [20:18] of the instruction.
The 'op' argument of helper_cache() contains the bits [20:16].
Extract the 3 bits and parse them using a switch case. This allow
us to handle multiple cache types (the cache type is encoded in
bits [17:16]).

Previously the if() block was only checking the D-Cache (Primary
Data or Unified Primary). Now we also handle the I-Cache (Primary
Instruction), S-Cache (Secondary) and T-Cache (Terciary).

Reported-by: Jiaxun Yang 
Signed-off-by: Philippe Mathieu-Daudé 


Reviewed-by: Jiaxun Yang 

Thanks~


---
  target/mips/op_helper.c | 11 +--
  1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
index 9552b280e0..92c399d8d4 100644
--- a/target/mips/op_helper.c
+++ b/target/mips/op_helper.c
@@ -1574,15 +1574,22 @@ void helper_msa_st_d(CPUMIPSState *env, uint32_t wd,
  void helper_cache(CPUMIPSState *env, target_ulong addr, uint32_t op)
  {
  #ifndef CONFIG_USER_ONLY
+uint32_t cache_operation = extract32(op, 2, 3);
  target_ulong index = addr & 0x1fff;
-if (op == 9) {
+
+switch (cache_operation) {
+case 0b010:
  /* Index Store Tag */
  memory_region_dispatch_write(env->itc_tag, index, env->CP0_TagLo,
   MO_64, MEMTXATTRS_UNSPECIFIED);
-} else if (op == 5) {
+break;
+case 0b001:
  /* Index Load Tag */
  memory_region_dispatch_read(env->itc_tag, index, >CP0_TagLo,
  MO_64, MEMTXATTRS_UNSPECIFIED);
+break;
+default:
+break;
  }
  #endif
  }

Re: [RFC PATCH v2 2/3] target/mips/op_helper: Document Invalidate/Writeback opcodes as no-op

2020-08-13 Thread Jiaxun Yang





在 2020/8/14 上午2:15, Philippe Mathieu-Daudé 写道:

QEMU does not model caches, so there is not much to do with the
Invalidate/Writeback opcodes. Make it explicit adding a comment.

Suggested-by: Jiaxun Yang 
Signed-off-by: Philippe Mathieu-Daudé 



Reviewed-by: Jiaxun Yang 

Thanks~


---
  target/mips/op_helper.c | 11 +++
  1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/mips/op_helper.c b/target/mips/op_helper.c
index 92c399d8d4..2496d1dd71 100644
--- a/target/mips/op_helper.c
+++ b/target/mips/op_helper.c
@@ -1578,16 +1578,19 @@ void helper_cache(CPUMIPSState *env, target_ulong addr, 
uint32_t op)
  target_ulong index = addr & 0x1fff;
  
  switch (cache_operation) {

-case 0b010:
-/* Index Store Tag */
+case 0b010: /* Index Store Tag */
  memory_region_dispatch_write(env->itc_tag, index, env->CP0_TagLo,
   MO_64, MEMTXATTRS_UNSPECIFIED);
  break;
-case 0b001:
-/* Index Load Tag */
+case 0b001: /* Index Load Tag */
  memory_region_dispatch_read(env->itc_tag, index, >CP0_TagLo,
  MO_64, MEMTXATTRS_UNSPECIFIED);
  break;
+case 0b000: /* Index Invalidate */
+case 0b100: /* Hit Invalidate */
+case 0b110: /* Hit Writeback */
+/* no-op */
+break;
  default:
  break;
  }

Re: [PATCH 2/2] target/mips: Add definition of Loongson-3A3000 CPU

2020-08-13 Thread Kaige Li


On 08/13/2020 06:37 PM, Jiaxun Yang wrote:




在 2020/8/13 下午5:41, Kaige Li 写道:

Add definition of the Loongson-3A3000 processor in QEMU.


Hi Kaige,

We're not defining Loongson-3A3000 in QEMU because we have
some features like Loongson-EXT2, VTLB not available currently, I'd
prefer define it after we add these features to TCG.

Loongson-3A4000's define is a exception to support KVM.

Ok, I see. This will be defined later, right?
Thanks.
Kaige.


Thanks.

- Jiaxun



Signed-off-by: Kaige Li 
---
  target/mips/translate_init.inc.c | 24 
  1 file changed, 24 insertions(+)

diff --git a/target/mips/translate_init.inc.c 
b/target/mips/translate_init.inc.c

index 0740819..2e98aff 100644
--- a/target/mips/translate_init.inc.c
+++ b/target/mips/translate_init.inc.c
@@ -829,6 +829,30 @@ const mips_def_t mips_defs[] = {
  .PABITS = 48,
  .insn_flags = CPU_LOONGSON3A,
  .mmu_type = MMU_TYPE_R4000,
+   },
+   {
+.name = "Loongson-3A3000",
+.CP0_PRid = 0x14630d,
+/* 64KB I-cache and d-cache. 4 way with 32 bit cache line 
size.  */
+.CP0_Config0 = MIPS_CONFIG0 | (0x1 << CP0C0_AR) | (0x2 << 
CP0C0_AT) |

+   (MMU_TYPE_R4000 << CP0C0_MT),
+.CP0_Config1 = MIPS_CONFIG1 | (1 << CP0C1_FP) | (63 << 
CP0C1_MMU) |
+   (2 << CP0C1_IS) | (5 << CP0C1_IL) | (3 << 
CP0C1_IA) |
+   (2 << CP0C1_DS) | (5 << CP0C1_DL) | (3 << 
CP0C1_DA) |
+   (1 << CP0C1_PC) | (1 << CP0C1_WR) | (1 << 
CP0C1_EP),
+.CP0_Config2 = MIPS_CONFIG2 | (5 << CP0C2_SS) | (5 << 
CP0C2_SL) |

+   (15 << CP0C2_SA),
+.CP0_Config3 = MIPS_CONFIG3 | (1 << CP0C3_LPA),
+.SYNCI_Step = 16,
+.CCRes = 2,
+.CP0_Status_rw_bitmask = 0x7DDB,
+.CP1_fcr0 = (0x5 << FCR0_PRID) | (0x1 << FCR0_REV) | (0x1 << 
FCR0_F64),

+.CP1_fcr31 = 0,
+.CP1_fcr31_rw_bitmask = 0xFF83,
+.SEGBITS = 48,
+.PABITS = 48,
+.insn_flags = CPU_LOONGSON3A,
+.mmu_type = MMU_TYPE_R4000,
  },
  {
  .name = "Loongson-3A4000",

Re: [PATCH] qcow2: flush qcow2 l2 meta for new allocated clusters

2020-08-13 Thread Ying Fang





On 8/7/2020 4:13 PM, Kevin Wolf wrote:

Am 07.08.2020 um 09:42 hat Ying Fang geschrieben:



On 8/6/2020 5:13 PM, Kevin Wolf wrote:

Am 05.08.2020 um 04:38 hat Ying Fang geschrieben:

From: fangying 

When qemu or qemu-nbd process uses a qcow2 image and configured with
'cache = none', it will write to the qcow2 image with a cache to cache
L2 tables, however the process will not use L2 tables without explicitly
calling the flush command or closing the mirror flash into the disk.
Which may cause the disk data inconsistent with the written data for
a long time. If an abnormal process exit occurs here, the issued written
data will be lost.

Therefore, in order to keep data consistency we need to flush the changes
to the L2 entry to the disk in time for the newly allocated cluster.

Signed-off-by: Ying Fang 


If you want to have data safely written to the disk after each write
request, you need to use cache=writethrough/directsync (in other words,
aliases that are equivalent to setting -device ...,write-cache=off).
Note that this will have a major impact on write performance.

cache=none means bypassing the kernel page cache (O_DIRECT), but not
flushing after each write request.


Well, IIUC, cache=none does not guarantee data safety and we should not
expect that. Then this patch can be ignored.


Indeed, cache=none is a writeback cache mode with all of the
consequences. In practice, this is normally good enough because the
guest OS will send flush requests when needed (e.g. because a guest
application called fsync()), but if the guest doesn't do this, it may
suffer data loss. This behaviour is comparable to a volatile disk cache
on real hard disks and is a good default, but sometimes you need a
writethrough cache mode at the cost of a performance penalty.


The late reply, thanks for your detailed explanation on the 'cache' 
option, having more understanding for it now.


Kevin

.

Re: [PATCH] hw: virtio-mem: detach the element fromt the virtqueue when error occurs

2020-08-13 Thread Li Qiang

David Hildenbrand  于2020年8月14日周五 上午1:15写道：
>
> On 13.08.20 18:46, Li Qiang wrote:
>
> For now we use "virtio-mem:" for the subject, without the "hw: "part.
>
> > If error occurs while processing the virtio request we should call
> > 'virtqueue_detach_element' to detach the element from the virtqueue
> > before free the elem.
>
> What's the effect of this? In all cases we trigger a virtio_error(), so
> do we really have to bother?
>

Though the 'in_use' will be reset to 0 while reseting the virtio device.
The mapped sglist will not be unammped.
There maybe some undesired behavior.  CC Paolo to make a confirmation.

Thanks,
Li Qiang

> >
> > Signed-off-by: Li Qiang 
> > ---
> >  hw/virtio/virtio-mem.c | 13 +++--
> >  1 file changed, 7 insertions(+), 6 deletions(-)
> >
> > diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
> > index 7740fc613f..5ac6c3ec67 100644
> > --- a/hw/virtio/virtio-mem.c
> > +++ b/hw/virtio/virtio-mem.c
> > @@ -318,8 +318,7 @@ static void virtio_mem_handle_request(VirtIODevice 
> > *vdev, VirtQueue *vq)
> >  if (iov_to_buf(elem->out_sg, elem->out_num, 0, , len) < len) {
> >  virtio_error(vdev, "virtio-mem protocol violation: invalid 
> > request"
> >   " size: %d", len);
> > -g_free(elem);
> > -return;
> > +goto out_free;
> >  }
> >
> >  if (iov_size(elem->in_sg, elem->in_num) <
> > @@ -327,8 +326,7 @@ static void virtio_mem_handle_request(VirtIODevice 
> > *vdev, VirtQueue *vq)
> >  virtio_error(vdev, "virtio-mem protocol violation: not enough 
> > space"
> >   " for response: %zu",
> >   iov_size(elem->in_sg, elem->in_num));
> > -g_free(elem);
> > -return;
> > +goto out_free;
> >  }
> >
> >  type = le16_to_cpu(req.type);
> > @@ -348,12 +346,15 @@ static void virtio_mem_handle_request(VirtIODevice 
> > *vdev, VirtQueue *vq)
> >  default:
> >  virtio_error(vdev, "virtio-mem protocol violation: unknown 
> > request"
> >   " type: %d", type);
> > -g_free(elem);
> > -return;
> > +goto out_free;
> >  }
> >
> >  g_free(elem);
> >  }
> > +
> > +out_free:
> > +virtqueue_detach_element(vq, elem, 0);
> > +g_free(elem);
> >  }
> >
> >  static void virtio_mem_get_config(VirtIODevice *vdev, uint8_t *config_data)
> >
>
>
> --
> Thanks,
>
> David / dhildenb
>

Re: [PATCH] hw: virtio-gpu: remove duplicated 'virtqueue_pop'

2020-08-13 Thread Li Qiang

Laszlo Ersek  于2020年8月14日周五 上午4:21写道：
>
> On 08/13/20 17:36, Li Qiang wrote:
> > Just use 'while (true)' to avoid duplicated.
> > No function change.
> >
> > Signed-off-by: Li Qiang 
> > ---
> >  hw/display/virtio-gpu.c | 8 +---
> >  1 file changed, 5 insertions(+), 3 deletions(-)
> >
> > diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> > index 5f0dd7c150..9cef313f5e 100644
> > --- a/hw/display/virtio-gpu.c
> > +++ b/hw/display/virtio-gpu.c
> > @@ -869,13 +869,15 @@ static void virtio_gpu_handle_ctrl(VirtIODevice 
> > *vdev, VirtQueue *vq)
> >  }
> >  #endif
> >
> > -cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
> > -while (cmd) {
> > +while (true) {
> > +cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
> > +if (!cmd) {
> > +break;
> > +}
> >  cmd->vq = vq;
> >  cmd->error = 0;
> >  cmd->finished = false;
> >  QTAILQ_INSERT_TAIL(>cmdq, cmd, next);
> > -cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
> >  }
> >
> >  virtio_gpu_process_cmdq(g);
> >
>
> There are (at least) three styles:
>
> (1)
>
> thing = get_next();
> while (is_valid(thing)) {
> ...
> thing = get_next();
> }
>
> (2)
>
> while (true) {
> thing = get_next();
> if (!is_valid(thing)) {
> break;
> }
> ...
>  }
>
> (3)
>
> while (is_valid(thing = get_next())) {
> ...
> }
>
> My opinion:
>
> - If the get_next() invocation is simple, then style (1) is perfectly fine.
>
> - Style (2) is the worst of all.
>
> - If style (1) is not appropriate for whatever reason, then style (3) is 
> frequently a good replacement. Style (3) is sometimes rejected by coding 
> style documents though. Style (3) is not usable if is_valid() is a 
> function-like macro that does not evaluate its argument exactly once. 
> Frequently, is_valid() is simply open-coded with C operators (using extra 
> parens), for example:
>
> while ((cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command 
> {
>
> or more verbosely
>
> while ((cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command))) 
> !=
>NULL) {
>
> If we really dislike style (1), then I'd propose style (3). I think the 
> present patch (style (2)) is a step back.
>

I have no strong opinion about the style(2) and style(3), just don't
like the dup of style(1).

Anyway, let Gerd do the choice. AFAICS, the qemu uses a lot of
stype(2)  to populate virtio requests.

Thanks,
Li Qiang

> Just my opinion of course; I don't feel too strongly about this.
>
> Laszlo
>

Re: [PATCH 2/2] migration: add vsock as data channel support





在 2020/8/12 17:52, Dr. David Alan Gilbert 写道:

* Longpeng(Mike) (longpe...@huawei.com) wrote:

The vsock channel is more widely use in some new features, for example,
the Nitro/Enclave. It can also be used as the migration channel.

Signed-off-by: Longpeng(Mike) 


OK; it might be worth adding some tests for this.


OK, I'll try when I'm free.


Can I ask what your use case is - is this migrating an L2 inside an L1
or what?

Yes, L2 migrationg is a potential use case for this. However, our use 
case is still focusing on the L1 migration.


There is no network stack in our platform ( [1] ), so we use the vsock 
channel to communicate between the QEMU (on x86/ARM) and an Agent (on a 
PCIe card), the source Agent will transport the data to the destination.


Links:
[1] 
https://kvmforum2019.sched.com/event/Tmzh/zero-next-generation-virtualization-platform-for-huawei-cloud-jinsong-liu-zhichao-huang-huawei




Reviewed-by: Dr. David Alan Gilbert 


Thanks.


---
  migration/migration.c | 6 --
  1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 3160b95..fcf7974 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -383,7 +383,8 @@ void qemu_start_incoming_migration(const char *uri, Error 
**errp)
  if (!strcmp(uri, "defer")) {
  deferred_incoming_migration(errp);
  } else if (strstart(uri, "tcp:", ) ||
-   strstart(uri, "unix:", NULL)) {
+   strstart(uri, "unix:", NULL) ||
+   strstart(uri, "vsock:", NULL)) {
  socket_start_incoming_migration(p ? p : uri, errp);
  #ifdef CONFIG_RDMA
  } else if (strstart(uri, "rdma:", )) {
@@ -2072,7 +2073,8 @@ void qmp_migrate(const char *uri, bool has_blk, bool blk,
  }
  
  if (strstart(uri, "tcp:", ) ||

-strstart(uri, "unix:", NULL)) {
+strstart(uri, "unix:", NULL) ||
+strstart(uri, "vsock:", NULL)) {
  socket_start_outgoing_migration(s, p ? p : uri, _err);
  #ifdef CONFIG_RDMA
  } else if (strstart(uri, "rdma:", )) {
--
1.8.3.1

[PATCH v2] nvram: Exit QEMU if NVRAM cannot contain all -prom-env data

2020-08-13 Thread Greg Kurz

Since commit 61f20b9dc5b7 ("spapr_nvram: Pre-initialize the NVRAM to
support the -prom-env parameter"), pseries machines can pre-initialize
the "system" partition in the NVRAM with the data passed to all -prom-env
parameters on the QEMU command line.

In this case it is assumed that all the data fits in 64 KiB, but the user
can easily pass more and crash QEMU:

$ qemu-system-ppc64 -M pseries $(for ((x=0;x<128;x++)); do \
  echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
  done) # this requires ~128 Kib
malloc(): corrupted top size
Aborted (core dumped)

This happens because we don't check if all the prom-env data fits in
the NVRAM and chrp_nvram_set_var() happily memcpy() it passed the
buffer.

This crash affects basically all ppc/ppc64 machine types that use -prom-env:
- pseries (all versions)
- g3beige
- mac99

and also sparc/sparc64 machine types:
- LX
- SPARCClassic
- SPARCbook
- SS-10
- SS-20
- SS-4
- SS-5
- SS-600MP
- Voyager
- sun4u
- sun4v

Add a max_len argument to chrp_nvram_create_system_partition() so that
it can check the available size before writing to memory.

Since NVRAM is populated at machine init, it seems reasonable to consider
this error as fatal. So, instead of reporting an error when we detect that
the NVRAM is too small and adapt all machine types to handle it, we simply
exit QEMU in all cases. This is still better than crashing. If someone
wants another behavior, I guess this can be reworked later.

Tested with:

$ yes q | \
  (for arch in ppc ppc64 sparc sparc64; do \
   echo == $arch ==; \
   qemu=${arch}-softmmu/qemu-system-$arch; \
   for mach in $($qemu -M help | awk '! /^Supported/ { print $1 }'); do \
   echo $mach; \
   $qemu -M $mach -monitor stdio -nodefaults -nographic \
   $(for ((x=0;x<128;x++)); do \
 echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
 done) >/dev/null; \
done; echo; \
   done)

Without the patch, affected machine types cause QEMU to report some
memory corruption and crash:

malloc(): corrupted top size

free(): invalid size

*** stack smashing detected ***: terminated

With the patch, QEMU prints the following message and exits:

NVRAM is too small. Try to pass less data to -prom-env

It seems that the conditions for the crash have always existed, but it
affects pseries, the machine type I care for, since commit 61f20b9dc5b7
only.

Fixes: 61f20b9dc5b7 ("spapr_nvram: Pre-initialize the NVRAM to support the 
-prom-env parameter")
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1867739
Reported-by: John Snow 
Reviewed-by: Laurent Vivier 
Signed-off-by: Greg Kurz 
---
v2: - fixed system partition size for sparc/sparc64 (Laurent)
---
 hw/nvram/chrp_nvram.c |   24 +---
 hw/nvram/mac_nvram.c  |2 +-
 hw/nvram/spapr_nvram.c|3 ++-
 hw/sparc/sun4m.c  |2 +-
 hw/sparc64/sun4u.c|2 +-
 include/hw/nvram/chrp_nvram.h |3 ++-
 6 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/hw/nvram/chrp_nvram.c b/hw/nvram/chrp_nvram.c
index d969f267048e..d4d10a7c03c7 100644
--- a/hw/nvram/chrp_nvram.c
+++ b/hw/nvram/chrp_nvram.c
@@ -21,14 +21,21 @@
 
 #include "qemu/osdep.h"
 #include "qemu/cutils.h"
+#include "qemu/error-report.h"
 #include "hw/nvram/chrp_nvram.h"
 #include "sysemu/sysemu.h"
 
-static int chrp_nvram_set_var(uint8_t *nvram, int addr, const char *str)
+static int chrp_nvram_set_var(uint8_t *nvram, int addr, const char *str,
+  int max_len)
 {
 int len;
 
 len = strlen(str) + 1;
+
+if (max_len < len) {
+return -1;
+}
+
 memcpy([addr], str, len);
 
 return addr + len;
@@ -38,19 +45,26 @@ static int chrp_nvram_set_var(uint8_t *nvram, int addr, 
const char *str)
  * Create a "system partition", used for the Open Firmware
  * environment variables.
  */
-int chrp_nvram_create_system_partition(uint8_t *data, int min_len)
+int chrp_nvram_create_system_partition(uint8_t *data, int min_len, int max_len)
 {
 ChrpNvramPartHdr *part_header;
 unsigned int i;
 int end;
 
+if (max_len < sizeof(*part_header)) {
+goto fail;
+}
+
 part_header = (ChrpNvramPartHdr *)data;
 part_header->signature = CHRP_NVPART_SYSTEM;
 pstrcpy(part_header->name, sizeof(part_header->name), "system");
 
 end = sizeof(ChrpNvramPartHdr);
 for (i = 0; i < nb_prom_envs; i++) {
-end = chrp_nvram_set_var(data, end, prom_envs[i]);
+end = chrp_nvram_set_var(data, end, prom_envs[i], max_len - end);
+if (end == -1) {
+goto fail;
+}
 }
 
 /* End marker */
@@ -65,6 +79,10 @@ int chrp_nvram_create_system_partition(uint8_t *data, int 
min_len)
 chrp_nvram_finish_partition(part_header, end);
 
 return end;
+
+fail:
+error_report("NVRAM is too small. Try to pass less data to -prom-env");
+exit(EXIT_FAILURE);
 }
 
 /**
diff --git a/hw/nvram/mac_nvram.c

Re: [PATCH 00/41] qom: Automated conversion of type checking boilerplate

Patchew URL: 
https://patchew.org/QEMU/20200813222625.243136-1-ehabk...@redhat.com/



Hi,

This series failed the docker-quick@centos7 build test. Please find the testing 
commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
make docker-image-centos7 V=1 NETWORK=1
time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
=== TEST SCRIPT END ===

  CC  hw/char/cmsdk-apb-uart.o
  CC  hw/char/debugcon.o
In file included from /tmp/qemu-test/src/hw/char/xen_console.c:29:0:
/tmp/qemu-test/src/include/hw/xen/xen-legacy-backend.h:13:1: error: unknown 
type name 'XenLegacyDevice'
 DECLARE_INSTANCE_CHECKER(XenLegacyDevice, XENBACKEND_DEVICE,
 ^
In file included from /tmp/qemu-test/src/include/chardev/char.h:7:0,
 from /tmp/qemu-test/src/include/chardev/char-fe.h:4,
 from /tmp/qemu-test/src/hw/char/xen_console.c:28:
/tmp/qemu-test/src/include/hw/xen/xen-legacy-backend.h: In function 
'XENBACKEND_DEVICE':
/tmp/qemu-test/src/include/hw/xen/xen-legacy-backend.h:13:26: error: 
'XenLegacyDevice' undeclared (first use in this function)
 DECLARE_INSTANCE_CHECKER(XenLegacyDevice, XENBACKEND_DEVICE,
  ^
/tmp/qemu-test/src/include/qom/object.h:863:7: note: in definition of macro 
'OBJECT_CHECK'
---
/tmp/qemu-test/src/include/hw/xen/xen-legacy-backend.h:13:1: note: in expansion 
of macro 'DECLARE_INSTANCE_CHECKER'
 DECLARE_INSTANCE_CHECKER(XenLegacyDevice, XENBACKEND_DEVICE,
 ^
/tmp/qemu-test/src/include/qom/object.h:863:13: error: expected expression 
before ')' token
 ((type *)object_dynamic_cast_assert(OBJECT(obj), (name), \
 ^
/tmp/qemu-test/src/include/qom/object.h:572:14: note: in expansion of macro 
'OBJECT_CHECK'
---
  CC  hw/core/nmi.o
  CC  hw/core/vm-change-state-handler.o
  CC  hw/core/qdev-properties-system.o
make: *** [hw/char/xen_console.o] Error 1
make: *** Waiting for unfinished jobs
Traceback (most recent call last):
  File "./tests/docker/docker.py", line 709, in 
---
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['sudo', '-n', 'docker', 'run', 
'--label', 'com.qemu.instance.uuid=f7ca9563df9146949361704266b7b696', '-u', 
'1003', '--security-opt', 'seccomp=unconfined', '--rm', '-e', 'TARGET_LIST=', 
'-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=14', '-e', 'DEBUG=', '-e', 
'SHOW_ENV=1', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', 
'/home/patchew2/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', 
'/var/tmp/patchew-tester-tmp-e8jv11ta/src/docker-src.2020-08-13-19.04.47.9512:/var/tmp/qemu:z,ro',
 'qemu/centos7', '/var/tmp/qemu/run', 'test-quick']' returned non-zero exit 
status 2.
filter=--filter=label=com.qemu.instance.uuid=f7ca9563df9146949361704266b7b696
make[1]: *** [docker-run] Error 1
make[1]: Leaving directory `/var/tmp/patchew-tester-tmp-e8jv11ta/src'
make: *** [docker-run-test-quick@centos7] Error 2

real2m38.413s
user0m8.492s


The full log is available at
http://patchew.org/logs/20200813222625.243136-1-ehabk...@redhat.com/testing.docker-quick@centos7/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

Re: [PATCH 00/41] qom: Automated conversion of type checking boilerplate

Patchew URL: 
https://patchew.org/QEMU/20200813222625.243136-1-ehabk...@redhat.com/



Hi,

This series failed the docker-mingw@fedora build test. Please find the testing 
commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#! /bin/bash
export ARCH=x86_64
make docker-image-fedora V=1 NETWORK=1
time make docker-test-mingw@fedora J=14 NETWORK=1
=== TEST SCRIPT END ===

  CC  stubs/error-printf.o
  CC  stubs/fdset.o
  CC  stubs/gdbstub.o
/tmp/qemu-test/src/docs/../include/exec/memory.h:353: warning: Function 
parameter or member 'parent_class' not described in 'IOMMUMemoryRegionClass'
/tmp/qemu-test/src/docs/../include/exec/memory.h:353: warning: Function 
parameter or member 'translate' not described in 'IOMMUMemoryRegionClass'
/tmp/qemu-test/src/docs/../include/exec/memory.h:353: warning: Function 
parameter or member 'get_min_page_size' not described in 
'IOMMUMemoryRegionClass'
/tmp/qemu-test/src/docs/../include/exec/memory.h:353: warning: Function 
parameter or member 'notify_flag_changed' not described in 
'IOMMUMemoryRegionClass'
/tmp/qemu-test/src/docs/../include/exec/memory.h:353: warning: Function 
parameter or member 'replay' not described in 'IOMMUMemoryRegionClass'
/tmp/qemu-test/src/docs/../include/exec/memory.h:353: warning: Function 
parameter or member 'get_attr' not described in 'IOMMUMemoryRegionClass'
/tmp/qemu-test/src/docs/../include/exec/memory.h:353: warning: Function 
parameter or member 'attrs_to_index' not described in 'IOMMUMemoryRegionClass'
/tmp/qemu-test/src/docs/../include/exec/memory.h:353: warning: Function 
parameter or member 'num_indexes' not described in 'IOMMUMemoryRegionClass'

Warning, treated as error:
/tmp/qemu-test/src/docs/../include/exec/memory.h:231:Unexpected indentation.
  CC  stubs/iothread-lock.o
  CC  stubs/is-daemonized.o
---
  CC  stubs/replay.o
  CC  stubs/runstate-check.o
  CC  stubs/semihost.o
make: *** [Makefile:1091: docs/devel/index.html] Error 2
make: *** Waiting for unfinished jobs
In file included from /tmp/qemu-test/src/include/exec/memory.h:28,
 from /tmp/qemu-test/src/include/hw/boards.h:6,
 from /tmp/qemu-test/src/include/hw/i386/pc.h:6,
 from /tmp/qemu-test/src/stubs/cmos.c:2:
/tmp/qemu-test/src/include/sysemu/accel.h:65:22: error: 'ACCEL' redeclared as 
different kind of symbol
   65 |  ACCEL, TYPE_ACCEL)
  |  ^
/tmp/qemu-test/src/include/qom/object.h:571:5: note: in definition of macro 
'DECLARE_INSTANCE_CHECKER'
---
/usr/x86_64-w64-mingw32/sys-root/mingw/include/winuser.h:1757:5: note: previous 
declaration of 'ACCEL' was here
 1757 |   } ACCEL,*LPACCEL;
  | ^
make: *** [/tmp/qemu-test/src/rules.mak:69: stubs/cmos.o] Error 1
Traceback (most recent call last):
  File "./tests/docker/docker.py", line 709, in 
sys.exit(main())
---
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['sudo', '-n', 'docker', 'run', 
'--label', 'com.qemu.instance.uuid=b3ca50017dd7489282ac17972d745e22', '-u', 
'1003', '--security-opt', 'seccomp=unconfined', '--rm', '-e', 'TARGET_LIST=', 
'-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=14', '-e', 'DEBUG=', '-e', 
'SHOW_ENV=', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', 
'/home/patchew2/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', 
'/var/tmp/patchew-tester-tmp-ot1u2siv/src/docker-src.2020-08-13-19.01.51.4315:/var/tmp/qemu:z,ro',
 'qemu/fedora', '/var/tmp/qemu/run', 'test-mingw']' returned non-zero exit 
status 2.
filter=--filter=label=com.qemu.instance.uuid=b3ca50017dd7489282ac17972d745e22
make[1]: *** [docker-run] Error 1
make[1]: Leaving directory `/var/tmp/patchew-tester-tmp-ot1u2siv/src'
make: *** [docker-run-test-mingw@fedora] Error 2

real2m3.343s
user0m8.454s


The full log is available at
http://patchew.org/logs/20200813222625.243136-1-ehabk...@redhat.com/testing.docker-mingw@fedora/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-de...@redhat.com

Re: [PATCH] spapr/xive: Use xive_source_esb_len()

2020-08-13 Thread Gustavo Romero


On 8/13/20 7:00 PM, Greg Kurz wrote:

On Thu, 13 Aug 2020 17:38:59 -0300
Gustavo Romero  wrote:


Hi Greg,



Hi Gustavo,


On 8/13/20 2:28 PM, Greg Kurz wrote:

static inline size_t xive_source_esb_len(XiveSource *xsrc)
{
  return (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
}

Signed-off-by: Greg Kurz 
---
Follow-up on "ppc/xive: Rework setup of XiveSource::esb_mmio"
http://patchwork.ozlabs.org/project/qemu-devel/patch/159679992680.876294.7520540158586170894.st...@bahia.lan/
---
   hw/intc/spapr_xive.c |2 +-
   hw/intc/spapr_xive_kvm.c |2 +-
   2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index 3c84f64dc464..4bd0d606ba17 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -336,7 +336,7 @@ static void spapr_xive_realize(DeviceState *dev, Error 
**errp)
   sysbus_init_mmio(SYS_BUS_DEVICE(xive), _xsrc->esb_mmio);
   
   /* Set the mapping address of the END ESB pages after the source ESBs */

-xive->end_base = xive->vc_base + (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
+xive->end_base = xive->vc_base + xive_source_esb_len(xsrc);
   
   /*

* Allocate the routing tables
diff --git a/hw/intc/spapr_xive_kvm.c b/hw/intc/spapr_xive_kvm.c
index 82a6f99f022d..3263b982239a 100644
--- a/hw/intc/spapr_xive_kvm.c
+++ b/hw/intc/spapr_xive_kvm.c
@@ -831,7 +831,7 @@ void kvmppc_xive_disconnect(SpaprInterruptController *intc)
   
   /* Clear the KVM mapping */

   xsrc = >source;
-esb_len = (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
+esb_len = xive_source_esb_len(xsrc);


hrm I'd like to not add another level of indirection here.
In this specific case I think it's more clear to read just

1ull << xsrc->esb_shift) * xsrc->nr_irqs

and get the idea of one IRQ per ESB page (or pair of pages,
for trigger and management), than one having to look at
what is inside "a box" called xive_source_esb_len().

Wrapping it under another function doesn't help more when
reading the code, XIVE is already tricky enough :)



Heh, XIVE is tricky enough that only a few people will dare
to touch this code and they'd better already know about the
one IRQ per ESB page thingy ;-)


Yea, maybe someday we get a cool documentation on it.

Luckily I came after Benh and Cédric and took some good info from
OPAL and QEMU code. I found out recently that XIVE support was
merged into FreeBSD and with that it also came some good comments
about xive...



More seriously, this is a matter of taste, but since you're likely
to be involved in XIVE a bit more than me, I'm perfectly fine with
keeping this open-coded.


Thanks, Greg.

Hope there is still some time to enjoy the summer over there :)


Cheers,
Gustavo

Re: [PATCH 00/41] qom: Automated conversion of type checking boilerplate

Patchew URL: 
https://patchew.org/QEMU/20200813222625.243136-1-ehabk...@redhat.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: 20200813222625.243136-1-ehabk...@redhat.com
Subject: [PATCH 00/41] qom: Automated conversion of type checking boilerplate

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

From https://github.com/patchew-project/qemu
 * [new tag] patchew/20200813222625.243136-1-ehabk...@redhat.com -> 
patchew/20200813222625.243136-1-ehabk...@redhat.com
Switched to a new branch 'test'
f1d2ad9 crypto: use QOM macros for declaration/definition of TLS creds types
4ea785b crypto: use QOM macros for declaration/definition of secret types
42307a9 Use OBJECT_DECLARE_SIMPLE_TYPE when possible
e1d9baa Use OBJECT_DECLARE_TYPE where possible
6d51dbd Use DECLARE_*CHECKER* when possible (--force mode)
2f68ebb Use DECLARE_*CHECKER* macros
d9a5329 Move QOM typedefs and add missing includes
d99bc90 Use TYPE_INFO macro
cf59308 Delete duplicate QOM typedefs
abb59d3 codeconverter: script for automating QOM code cleanups
c3aacb7 qom: TYPE_INFO macro
6a1dc81 qom: Make type checker functions accept const pointers
94dc349 qom: DECLARE_*_CHECKERS macros
c7d59ae qom: Allow class type name to be specified in OBJECT_DECLARE*
2d59458 qom: Fix G_DEFINE_AUTOPTR_CLEANUP_FUNC
4902ffa qom: provide convenient macros for declaring and defining types
f4ee4e0 qom: make object_ref/unref use a void * instead of Object *.
a47330a platform-bus: Delete macros for non-existing typedef
5bdcdd1 nubus: Delete unused NUBUS_BRIDGE macro
4082689 can_emu: Delete macros for non-existing typedef
d6afc42 s390_flic: Move KVMS390FLICState typedef to header
4579395 mcf_fec: Move mcf_fec_state typedef to header
770881d hvf: Move HVFState typedef to hvf.h
7eff325 i8254: Move PITCommonState/PITCommonClass typedefs to i8254.h
3736e8e pci: Move PCIBusClass typedef to pci.h
5634fc5 throttle-groups: Move ThrottleGroup typedef to header
0001856 tulip: Move TulipState typedef to header
0932b2f hcd-dwc2: Rename USB_*CLASS macros for consistency
d8cad90 hvf: Add missing include
2624fbf virtio-ccw: Fix definition of VIRTIO_CCW_BUS_GET_CLASS
4342dcc versatile: Fix typo in PCI_VPB_HOST definition
f533849 sifive_u: Rename memmap enum constants
330246d sifive_e: Rename memmap enum constants
a4e4116 opentitan: Rename memmap enum constants
3d055c7 aspeed_soc: Rename memmap/irqmap enum constants
9277ac1 allwinner-h3: Rename memmap enum constants
a4deb35 aspeed_timer: Fix ASPEED_TIMER macro definition
c4d2996 vmw_pvscsi: Rename QOM class cast macros
6fc2746 megasas: Rename QOM class cast macros
df20ed6 e1000: Rename QOM class cast macros
8366582 pl1110: Rename PL1110 enum

=== OUTPUT BEGIN ===
1/41 Checking commit 836658277f31 (pl1110: Rename PL1110 enum)
2/41 Checking commit df20ed682a35 (e1000: Rename QOM class cast macros)
3/41 Checking commit 6fc2746358e3 (megasas: Rename QOM class cast macros)
4/41 Checking commit c4d299612aea (vmw_pvscsi: Rename QOM class cast macros)
5/41 Checking commit a4deb3526872 (aspeed_timer: Fix ASPEED_TIMER macro 
definition)
6/41 Checking commit 9277ac1f1341 (allwinner-h3: Rename memmap enum constants)
WARNING: line over 80 characters
#128: FILE: hw/arm/allwinner-h3.c:328:
+memory_region_add_subregion(get_system_memory(), 
s->memmap[AW_H3_DEV_SRAM_A1],

WARNING: line over 80 characters
#131: FILE: hw/arm/allwinner-h3.c:330:
+memory_region_add_subregion(get_system_memory(), 
s->memmap[AW_H3_DEV_SRAM_A2],

WARNING: line over 80 characters
#134: FILE: hw/arm/allwinner-h3.c:332:
+memory_region_add_subregion(get_system_memory(), 
s->memmap[AW_H3_DEV_SRAM_C],

WARNING: line over 80 characters
#145: FILE: hw/arm/allwinner-h3.c:341:
+sysbus_mmio_map(SYS_BUS_DEVICE(>sysctrl), 0, 
s->memmap[AW_H3_DEV_SYSCTRL]);

WARNING: line over 80 characters
#254: FILE: hw/arm/orangepi.c:82:
+object_property_set_uint(OBJECT(h3), "ram-addr", 
h3->memmap[AW_H3_DEV_SDRAM],

WARNING: line over 80 characters
#263: FILE: hw/arm/orangepi.c:101:
+memory_region_add_subregion(get_system_memory(), 
h3->memmap[AW_H3_DEV_SDRAM],

total: 0 errors, 6 warnings, 310 lines checked

Patch 6/41 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
7/41 Checking commit 3d055c796062 (aspeed_soc: Rename memmap/irqmap enum 
constants)
8/41 Checking commit a4e4116b7873 (opentitan: Rename memmap enum constants)
WARNING: line over 80 characters
#152: FILE: hw/riscv/opentitan.c:174:
+memmap[IBEX_DEV_ALERT_HANDLER].base, 
memmap[IBEX_DEV_ALERT_HANDLER].size);

total: 0 errors, 1 warnings, 184 lines checked

Patch 8/41 has style problems, please review.  If any of these

[Bug 1889411] Re: RISC-V: Unable to unwind the stack upon signals

Can you test with mainline GDB and not a fork?

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1889411

Title:
  RISC-V: Unable to unwind the stack upon signals

Status in QEMU:
  New

Bug description:
  Consider the following program:

  ===
  #include 
  #include 

  #define NOINLINE __attribute__ ((noinline))

  void NOINLINE abort_me(void) { abort(); /* trigger SIGABRT */ }

  void NOINLINE level1(void) { abort_me(); }

  void NOINLINE level2(void) { level1(); }

  void NOINLINE level3(void) { level2(); }

  void NOINLINE level4(void) { level3();}

  int main(void) {
level4();
return 0;
  }
  ===

  $ riscv64-linux-gnu-gcc -march=rv64imafdc -O0 -g c.c
  $ qemu-riscv64 -g 31337 ./c &
  $ riscv64-unknown-linux-gnu-gdb -q -ex 'target remote localhost:31337' -ex 'b 
abort_me' -ex c -ex bt ./c
  Reading symbols from c...
  Remote debugging using localhost:31337
  Reading symbols from 
/home/lewurm/riscv/sysroot/lib/ld-linux-riscv64-lp64d.so.1...
  0x004000804f30 in _start () from 
/home/lewurm/riscv/sysroot/lib/ld-linux-riscv64-lp64d.so.1
  Breakpoint 1 at 0x400632: file c.c, line 7.
  Continuing.

  Breakpoint 1, abort_me () at c.c:7
  7   abort(); /* trigger SIGABRT */
  #0  abort_me () at c.c:7
  #1  0x00400642 in level1 () at c.c:11
  #2  0x00400658 in level2 () at c.c:15
  #3  0x0040066e in level3 () at c.c:19
  #4  0x00400684 in level4 () at c.c:23
  #5  0x0040069a in main () at c.c:27
  ===

  So far so good, I get a proper backtrace as expected. If I let the
  signal trigger however, gdb is not able to unwind the stack:

  (gdb) c
  Continuing.

  Program received signal SIGABRT, Aborted.
  0x004000858074 in ?? ()
  (gdb) bt
  #0  0x004000858074 in ?? ()


  I get the same behaviour for SIGSEGV and SIGILL, I didn't try other
  signals. Apparently this scenario works on real hardware (see linked
  gdb issue below), and presumably it would work with system qemu (I
  haven't tested that yet though). So my guess is that qemu does
  something differently around signal handling than the linux kernel.

  
  Full reproducer: 
https://gist.github.com/lewurm/befb9ddf5894bad9628b1df77258598b
  RISC-V GDB issue: https://github.com/riscv/riscv-binutils-gdb/issues/223

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1889411/+subscriptions

Re: [PATCH] nvram: Exit QEMU if NVRAM cannot contain all -prom-env data

2020-08-13 Thread Laurent Vivier

Le 13/08/2020 à 17:55, Greg Kurz a écrit :
> Since commit 61f20b9dc5b7 ("spapr_nvram: Pre-initialize the NVRAM to
> support the -prom-env parameter"), pseries machines can pre-initialize
> the "system" partition in the NVRAM with the data passed to all -prom-env
> parameters on the QEMU command line.
> 
> In this case it is assumed that all the data fits in 64 KiB, but the user
> can easily pass more and crash QEMU:
> 
> $ qemu-system-ppc64 -M pseries $(for ((x=0;x<128;x++)); do \
>   echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
>   done) # this requires ~128 Kib
> malloc(): corrupted top size
> Aborted (core dumped)
> 
> This happens because we don't check if all the prom-env data fits in
> the NVRAM and chrp_nvram_set_var() happily memcpy() it passed the
> buffer.
> 
> This crash affects basically all ppc/ppc64 machine types that use -prom-env:
> - pseries (all versions)
> - g3beige
> - mac99
> 
> and also sparc/sparc64 machine types:
> - LX
> - SPARCClassic
> - SPARCbook
> - SS-10
> - SS-20
> - SS-4
> - SS-5
> - SS-600MP
> - Voyager
> - sun4u
> - sun4v
> 
> Add a max_len argument to chrp_nvram_create_system_partition() so that
> it can check the available size before writing to memory.
> 
> Since NVRAM is populated at machine init, it seems reasonable to consider
> this error as fatal. So, instead of reporting an error when we detect that
> the NVRAM is too small and adapt all machine types to handle it, we simply
> exit QEMU in all cases. This is still better than crashing. If someone
> wants another behavior, I guess this can be reworked later.
> 
> Tested with:
> 
> $ yes q | \
>   (for arch in ppc ppc64 sparc sparc64; do \
>echo == $arch ==; \
>qemu=${arch}-softmmu/qemu-system-$arch; \
>for mach in $($qemu -M help | awk '! /^Supported/ { print $1 }'); do \
>echo $mach; \
>$qemu -M $mach -monitor stdio -nodefaults -nographic \
>$(for ((x=0;x<128;x++)); do \
>  echo -n " -prom-env " ; printf "%0.sx" {1..1024}; \
>  done) >/dev/null; \
> done; echo; \
>done)
> 
> Without the patch, affected machine types cause QEMU to report some
> memory corruption and crash:
> 
> malloc(): corrupted top size
> 
> free(): invalid size
> 
> *** stack smashing detected ***: terminated
> 
> With the patch, QEMU prints the following message and exits:
> 
> NVRAM is too small. Try to pass less data to -prom-env
> 
> It seems that the conditions for the crash have always existed, but it
> affects pseries, the machine type I care for, since commit 61f20b9dc5b7
> only.
> 
> Fixes: 61f20b9dc5b7 ("spapr_nvram: Pre-initialize the NVRAM to support the 
> -prom-env parameter")
> RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1867739
> Reported-by: John Snow 
> Signed-off-by: Greg Kurz 
> ---
> 
> This replaces the following series:
> 
> [PATCH v2 0/2] spapr/nvram: Fix QEMU crash
> http://patchwork.ozlabs.org/project/qemu-devel/list/?series=195269
> ---
>  hw/nvram/chrp_nvram.c |   24 +---
>  hw/nvram/mac_nvram.c  |2 +-
>  hw/nvram/spapr_nvram.c|3 ++-
>  hw/sparc/sun4m.c  |2 +-
>  hw/sparc64/sun4u.c|2 +-
>  include/hw/nvram/chrp_nvram.h |3 ++-
>  6 files changed, 28 insertions(+), 8 deletions(-)
> 
...
> diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
> index 9be930415f8e..7d791ee82368 100644
> --- a/hw/sparc/sun4m.c
> +++ b/hw/sparc/sun4m.c
> @@ -143,7 +143,7 @@ static void nvram_init(Nvram *nvram, uint8_t *macaddr,
>  memset(image, '\0', sizeof(image));
>  
>  /* OpenBIOS nvram variables partition */
> -sysp_end = chrp_nvram_create_system_partition(image, 0);
> +sysp_end = chrp_nvram_create_system_partition(image, 0, sizeof(image));
>  
>  /* Free space partition */
>  chrp_nvram_create_free_partition([sysp_end], 0x1fd0 - sysp_end);

It seems the max size of the system partition is 0x1fd0, not sizeof(image).

> diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
> index 9e30203dcc44..bd0a6283f339 100644
> --- a/hw/sparc64/sun4u.c
> +++ b/hw/sparc64/sun4u.c
> @@ -136,7 +136,7 @@ static int sun4u_NVRAM_set_params(Nvram *nvram, uint16_t 
> NVRAM_size,
>  memset(image, '\0', sizeof(image));
>  
>  /* OpenBIOS nvram variables partition */
> -sysp_end = chrp_nvram_create_system_partition(image, 0);
> +sysp_end = chrp_nvram_create_system_partition(image, 0, sizeof(image));
>  
>  /* Free space partition */
>  chrp_nvram_create_free_partition([sysp_end], 0x1fd0 - sysp_end);

ditto

All the other changes seem good.

With the sizeof(image) fixed:

Reviewed-by: Laurent Vivier

[PATCH 28/41] qom: Allow class type name to be specified in OBJECT_DECLARE*

Many QOM types don't follow the Type/TypeClass pattern
on the instance/struct names.  Let the class struct name
be specified in the OBJECT_DECLARE* macros.

Signed-off-by: Eduardo Habkost 
---
 include/qom/object.h | 35 ++-
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index f515230f61..500e7dfa99 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -555,7 +555,8 @@ struct Object
 
 /**
  * OBJECT_DECLARE_TYPE:
- * @ModuleObjName: the object name with initial capitalization
+ * @InstanceType: instance struct name
+ * @ClassType: class struct name
  * @module_obj_name: the object name in lowercase with underscore separators
  * @MODULE_OBJ_NAME: the object name in uppercase with underscore separators
  *
@@ -567,33 +568,33 @@ struct Object
  *
  * The object struct and class struct need to be declared manually.
  */
-#define OBJECT_DECLARE_TYPE(ModuleObjName, module_obj_name, MODULE_OBJ_NAME) \
-typedef struct ModuleObjName ModuleObjName; \
-typedef struct ModuleObjName##Class ModuleObjName##Class; \
+#define OBJECT_DECLARE_TYPE(InstanceType, ClassType, module_obj_name, 
MODULE_OBJ_NAME) \
+typedef struct InstanceType InstanceType; \
+typedef struct ClassType ClassType; \
 \
-G_DEFINE_AUTOPTR_CLEANUP_FUNC(ModuleObjName, object_unref) \
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(InstanceType, object_unref) \
 \
-static inline G_GNUC_UNUSED ModuleObjName##Class * \
+static inline G_GNUC_UNUSED ClassType * \
 MODULE_OBJ_NAME##_GET_CLASS(void *obj) \
-{ return OBJECT_GET_CLASS(ModuleObjName##Class, obj, \
+{ return OBJECT_GET_CLASS(ClassType, obj, \
   TYPE_##MODULE_OBJ_NAME); } \
 \
-static inline G_GNUC_UNUSED ModuleObjName##Class * \
+static inline G_GNUC_UNUSED ClassType * \
 MODULE_OBJ_NAME##_CLASS(void *klass) \
-{ return OBJECT_CLASS_CHECK(ModuleObjName##Class, klass, \
+{ return OBJECT_CLASS_CHECK(ClassType, klass, \
 TYPE_##MODULE_OBJ_NAME); } \
 \
-static inline G_GNUC_UNUSED ModuleObjName * \
+static inline G_GNUC_UNUSED InstanceType * \
 MODULE_OBJ_NAME(void *obj) \
-{ return OBJECT_CHECK(ModuleObjName, obj, \
+{ return OBJECT_CHECK(InstanceType, obj, \
   TYPE_##MODULE_OBJ_NAME); }
 
 /**
  * OBJECT_DECLARE_SIMPLE_TYPE:
- * @ModuleObjName: the object name with initial caps
+ * @InstanceType: instance struct name
  * @module_obj_name: the object name in lowercase with underscore separators
  * @MODULE_OBJ_NAME: the object name in uppercase with underscore separators
- * @ParentModuleObjName: the parent object name with initial caps
+ * @ParentClassType: class struct name of parent type
  *
  * This does the same as OBJECT_DECLARE_TYPE(), but also declares
  * the class struct, thus only the object struct needs to be declare
@@ -602,10 +603,10 @@ struct Object
  * This macro should be used unless the class struct needs to have
  * virtual methods declared.
  */
-#define OBJECT_DECLARE_SIMPLE_TYPE(ModuleObjName, module_obj_name, \
-   MODULE_OBJ_NAME, ParentModuleObjName) \
-OBJECT_DECLARE_TYPE(ModuleObjName, module_obj_name, MODULE_OBJ_NAME) \
-struct ModuleObjName##Class { ParentModuleObjName##Class parent_class; };
+#define OBJECT_DECLARE_SIMPLE_TYPE(InstanceType, module_obj_name, \
+   MODULE_OBJ_NAME, ParentClassType) \
+OBJECT_DECLARE_TYPE(InstanceType, InstanceType##Class, module_obj_name, 
MODULE_OBJ_NAME) \
+struct InstanceType##Class { ParentClassType parent_class; };
 
 
 /**
-- 
2.26.2

[Bug 1886076] Re: risc-v pmp implementation error

I'm marking this as fix committed, although the fix isn't yet in master
it's in the RISC-V tree and will be in master soon.

** Changed in: qemu
   Status: New => Fix Committed

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1886076

Title:
  risc-v pmp implementation error

Status in QEMU:
  Fix Committed

Bug description:
  QEMU Commit fc1bff958998910ec8d25db86cd2f53ff125f7ab

  
  RISC-V PMP implementation is not correct on QEMU.

  When an access is granted there is no more PMP check on the 4KB memory range 
of the accessed location.
  A cache flush is needed in order to force a PMP check on next access to this 
4KB memory range.
  A correct implementation would be to grant access to the maximum allowed area 
around the accessed location within the 4KB memory range.

  For instance, if PMP is configured to block all accesses from 0x80003000 to 
0x800037FF and from 0x80003C00 to 0x80003FFF:
  1st case:
  1) A read access is done @0x80003900 --> access OK as expected
  2) Then a read access is done @0x80003400 --> access OK while it must be 
blocked!
  2nd case:
  1) A read access is done @0x80003900 --> access OK as expected
  2) Cache is flushed (__asm__ __volatile__ ("sfence.vma" : : : "memory");) 
 
  3) A read access is done @0x80003400 --> access blocked as expected

  Analysis:
  After the 1st read @0x80003900 QEMU add the memory range 0x80003000 to 
0x80003FFF into a TLB entry.
  Then no more PMP check is done from 0x80003000 to 0x80003FFF until the 
TLB is flushed.
  What should be done:
  Only the range 0x80003800 to 0x80003BFF should be added to the TLB entry.

  The 4KB range is the default size of a TLB page on QEMU for RISCV.
  The minimum size that can be set is 64Bytes. However the PMP granularity can 
be as low as 4Bytes.

  I tested a quick fix and PMP is working as expected.
  The quick fix consist in replacing this line:
  tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK, prot, 
mmu_idx, TARGET_PAGE_SIZE);
  By this one in target/riscv/cpu_helper.c:
  tlb_set_page(cs, address & ~0x3, pa & ~0x3, prot, mmu_idx, size);

  This quick fix has to be optimized in order to consume less HW
  resources, as explained at the beginning.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1886076/+subscriptions

[PATCH 38/41] [automated] Use OBJECT_DECLARE_TYPE where possible

Replace DECLARE_OBJ_CHECKERS with OBJECT_DECLARE_TYPE where the
typedefs can be safely removed.

Generated running:

$ ./scripts/codeconverter/converter.py -i \
  --pattern=DeclareObjCheckers $(git grep -l '' -- '*.[ch]')

Signed-off-by: Eduardo Habkost 
---
 hw/audio/intel-hda.h| 6 ++
 hw/display/virtio-vga.h | 6 ++
 include/authz/base.h| 6 ++
 include/authz/list.h| 6 ++
 include/authz/listfile.h| 6 ++
 include/authz/pamacct.h | 6 ++
 include/authz/simple.h  | 6 ++
 include/crypto/secret_common.h  | 6 ++
 include/crypto/secret_keyring.h | 6 ++
 include/hw/hyperv/vmbus.h   | 6 ++
 include/hw/i2c/i2c.h| 6 ++
 include/hw/i2c/smbus_slave.h| 6 ++
 include/hw/ipack/ipack.h| 6 ++
 include/hw/ipmi/ipmi.h  | 6 ++
 include/hw/mem/pc-dimm.h| 6 ++
 include/hw/ppc/pnv.h| 6 ++
 include/hw/ppc/pnv_core.h   | 6 ++
 include/hw/ppc/pnv_homer.h  | 6 ++
 include/hw/ppc/pnv_occ.h| 6 ++
 include/hw/ppc/pnv_psi.h| 6 ++
 include/hw/ppc/pnv_xive.h   | 6 ++
 include/hw/ppc/spapr_cpu_core.h | 6 ++
 include/hw/ppc/spapr_drc.h  | 6 ++
 include/hw/ppc/spapr_vio.h  | 6 ++
 include/hw/ppc/spapr_xive.h | 6 ++
 include/hw/ppc/xics.h   | 6 ++
 include/hw/ppc/xive.h   | 6 ++
 include/hw/s390x/event-facility.h   | 6 ++
 include/hw/s390x/s390_flic.h| 6 ++
 include/hw/s390x/sclp.h | 6 ++
 include/hw/sd/sd.h  | 6 ++
 include/hw/ssi/ssi.h| 6 ++
 include/hw/sysbus.h | 6 ++
 include/hw/virtio/virtio-gpu.h  | 6 ++
 include/hw/virtio/virtio-input.h| 6 ++
 include/hw/virtio/virtio-mem.h  | 6 ++
 include/hw/virtio/virtio-pmem.h | 6 ++
 include/hw/virtio/virtio-serial.h   | 6 ++
 include/hw/xen/xen-bus.h| 6 ++
 include/io/channel.h| 6 ++
 include/io/dns-resolver.h   | 6 ++
 include/io/net-listener.h   | 6 ++
 include/scsi/pr-manager.h   | 6 ++
 include/sysemu/cryptodev.h  | 6 ++
 include/sysemu/hostmem.h| 6 ++
 include/sysemu/rng.h| 6 ++
 include/sysemu/tpm_backend.h| 6 ++
 include/sysemu/vhost-user-backend.h | 6 ++
 target/alpha/cpu-qom.h  | 6 ++
 target/arm/cpu-qom.h| 6 ++
 target/avr/cpu-qom.h| 6 ++
 target/cris/cpu-qom.h   | 6 ++
 target/hppa/cpu-qom.h   | 6 ++
 target/i386/cpu-qom.h   | 6 ++
 target/lm32/cpu-qom.h   | 6 ++
 target/m68k/cpu-qom.h   | 6 ++
 target/microblaze/cpu-qom.h | 6 ++
 target/mips/cpu-qom.h   | 6 ++
 target/moxie/cpu.h  | 6 ++
 target/nios2/cpu.h  | 6 ++
 target/openrisc/cpu.h   | 6 ++
 target/ppc/cpu-qom.h| 6 ++
 target/riscv/cpu.h  | 6 ++
 target/s390x/cpu-qom.h  | 6 ++
 target/sh4/cpu-qom.h| 6 ++
 target/sparc/cpu-qom.h  | 6 ++
 target/tilegx/cpu.h | 6 ++
 target/tricore/cpu-qom.h| 6 ++
 target/unicore32/cpu-qom.h  | 6 ++
 target/xtensa/cpu-qom.h | 6 ++
 backends/dbus-vmstate.c | 6 ++
 ui/input-barrier.c  | 6 ++
 ui/input-linux.c| 6 ++
 73 files changed, 146 insertions(+), 292 deletions(-)

diff --git a/hw/audio/intel-hda.h b/hw/audio/intel-hda.h
index 813a7a357d..f5cce18fa3 100644
--- a/hw/audio/intel-hda.h
+++ b/hw/audio/intel-hda.h
@@ -8,10 +8,8 @@
 /* hda bus   */
 
 #define TYPE_HDA_CODEC_DEVICE "hda-codec"
-typedef struct HDACodecDevice HDACodecDevice;
-typedef struct HDACodecDeviceClass HDACodecDeviceClass;
-DECLARE_OBJ_CHECKERS(HDACodecDevice, HDACodecDeviceClass,
- HDA_CODEC_DEVICE, TYPE_HDA_CODEC_DEVICE)
+OBJECT_DECLARE_TYPE(HDACodecDevice, HDACodecDeviceClass,
+hda_codec_device, HDA_CODEC_DEVICE)
 
 #define TYPE_HDA_BUS "HDA"
 typedef struct HDACodecBus HDACodecBus;
diff --git a/hw/display/virtio-vga.h b/hw/display/virtio-vga.h
index 19f8af7356..5c5671c9c1 100644
--- a/hw/display/virtio-vga.h
+++ b/hw/display/virtio-vga.h
@@ -9,10 +9,8 @@
  * virtio-vga-base: This extends VirtioPCIProxy.
  */
 #define TYPE_VIRTIO_VGA_BASE "virtio-vga-base"
-typedef struct VirtIOVGABase VirtIOVGABase;
-typedef struct VirtIOVGABaseClass VirtIOVGABaseClass;
-DECLARE_OBJ_CHECKERS(VirtIOVGABase, VirtIOVGABaseClass,
- VIRTIO_VGA_BASE,

[PATCH 32/41] codeconverter: script for automating QOM code cleanups

This started as a simple script that scanned for regular
expressions, but became more and more complex when exceptions to
the rules were found.

I don't know if this should be maintained in the QEMU source tree
long term (maybe it can be reused for other code transformations
that Coccinelle can't handle).  In either case, this is included
as part of the patch series to document how exactly the automated
code transformations in the next patches were done.

Signed-off-by: Eduardo Habkost 
---
 .../codeconverter/codeconverter/__init__.py   |   0
 .../codeconverter/codeconverter/patching.py   | 369 +++
 .../codeconverter/codeconverter/qom_macros.py | 614 ++
 .../codeconverter/qom_type_info.py| 314 +
 .../codeconverter/codeconverter/regexps.py|  89 +++
 .../codeconverter/test_patching.py|  98 +++
 .../codeconverter/test_regexps.py | 272 
 scripts/codeconverter/codeconverter/utils.py  |  65 ++
 scripts/codeconverter/converter.py| 113 
 9 files changed, 1934 insertions(+)
 create mode 100644 scripts/codeconverter/codeconverter/__init__.py
 create mode 100644 scripts/codeconverter/codeconverter/patching.py
 create mode 100644 scripts/codeconverter/codeconverter/qom_macros.py
 create mode 100644 scripts/codeconverter/codeconverter/qom_type_info.py
 create mode 100644 scripts/codeconverter/codeconverter/regexps.py
 create mode 100644 scripts/codeconverter/codeconverter/test_patching.py
 create mode 100644 scripts/codeconverter/codeconverter/test_regexps.py
 create mode 100644 scripts/codeconverter/codeconverter/utils.py
 create mode 100755 scripts/codeconverter/converter.py

diff --git a/scripts/codeconverter/codeconverter/__init__.py 
b/scripts/codeconverter/codeconverter/__init__.py
new file mode 100644
index 00..e69de29bb2
diff --git a/scripts/codeconverter/codeconverter/patching.py 
b/scripts/codeconverter/codeconverter/patching.py
new file mode 100644
index 00..1c722786d2
--- /dev/null
+++ b/scripts/codeconverter/codeconverter/patching.py
@@ -0,0 +1,369 @@
+from typing import IO, Match, NamedTuple, Optional, Literal, Iterable, Type, 
Dict, List, Any, TypeVar, NewType, Tuple
+from itertools import chain
+from tempfile import NamedTemporaryFile
+import os
+import re
+import subprocess
+from io import StringIO
+
+import logging
+logger = logging.getLogger(__name__)
+DBG = logger.debug
+INFO = logger.info
+WARN = logger.warning
+ERROR = logger.error
+
+from .utils import *
+
+T = TypeVar('T')
+
+class Patch(NamedTuple):
+# start inside file.original_content
+start: int
+# end position inside file.original_content
+end: int
+# replacement string for file.original_content[start:end]
+replacement: str
+
+IdentifierType = Literal['type', 'symbol', 'include', 'constant']
+class RequiredIdentifier(NamedTuple):
+type: IdentifierType
+name: str
+
+class FileMatch:
+"""Base class for regex matches
+
+Subclasses just need to set the `regexp` class attribute
+"""
+regexp: Optional[str] = None
+
+def __init__(self, f: 'FileInfo', m: Match) -> None:
+self.file: 'FileInfo' = f
+self.match: Match = m
+
+@property
+def name(self) -> str:
+if 'name' not in self.match.groupdict():
+return '[no name]'
+return self.group('name')
+
+@classmethod
+def compiled_re(klass):
+return re.compile(klass.regexp, re.MULTILINE)
+
+def start(self) -> int:
+return self.match.start()
+
+def end(self) -> int:
+return self.match.end()
+
+def line_col(self) -> LineAndColumn:
+return self.file.line_col(self.start())
+
+def group(self, *args):
+return self.match.group(*args)
+
+def log(self, level, fmt, *args) -> None:
+pos = self.line_col()
+logger.log(level, '%s:%d:%d: '+fmt, self.file.filename, pos.line, 
pos.col, *args)
+
+def warn(self, fmt, *args) -> None:
+self.log(logging.WARNING, fmt, *args)
+
+def error(self, fmt, *args) -> None:
+self.log(logging.ERROR, fmt, *args)
+
+def sub(self, original: str, replacement: str) -> str:
+"""Replace content
+
+XXX: this won't use the match position, but will just
+replace all strings that look like the original match.
+This should be enough for all the patterns used in this
+script.
+"""
+return original.replace(self.group(0), replacement)
+
+def sanity_check(self) -> None:
+"""Sanity check match, and print warnings if necessary"""
+pass
+
+def replacement(self) -> Optional[str]:
+"""Return replacement text for pattern, to use new code conventions"""
+return None
+
+def make_patch(self, replacement: str) -> 'Patch':
+"""Make patch replacing the content of this match"""
+return Patch(self.start(), self.end(), replacement)
+
+def make_removal_patch(self) -> 'Patch':
+

[PATCH 33/41] [automated] Delete duplicate QOM typedefs

Generated using:

 $ ./scripts/codeconverter/converter.py -i \
   --pattern=QOMDuplicatedTypedefs $(git grep -l '' -- '*.[ch]')

Signed-off-by: Eduardo Habkost 
---
 include/crypto/secret_keyring.h | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/crypto/secret_keyring.h b/include/crypto/secret_keyring.h
index 9f371ad251..4345eb048e 100644
--- a/include/crypto/secret_keyring.h
+++ b/include/crypto/secret_keyring.h
@@ -39,14 +39,14 @@
 typedef struct QCryptoSecretKeyring QCryptoSecretKeyring;
 typedef struct QCryptoSecretKeyringClass QCryptoSecretKeyringClass;
 
-typedef struct QCryptoSecretKeyring {
+struct QCryptoSecretKeyring {
 QCryptoSecretCommon parent;
 int32_t serial;
-} QCryptoSecretKeyring;
+};
 
 
-typedef struct QCryptoSecretKeyringClass {
+struct QCryptoSecretKeyringClass {
 QCryptoSecretCommonClass parent;
-} QCryptoSecretKeyringClass;
+};
 
 #endif /* QCRYPTO_SECRET_KEYRING_H */
-- 
2.26.2

[PATCH 40/41] crypto: use QOM macros for declaration/definition of secret types

From: Daniel P. Berrangé 

This introduces the use of the OBJECT_DEFINE and OBJECT_DECLARE macro
families in the secret types, in order to eliminate boilerplate code.

Signed-off-by: Daniel P. Berrangé 
Message-Id: <20200723181410.3145233-4-berra...@redhat.com>
[ehabkost: rebase, update to pass additional arguments to macro]
Signed-off-by: Eduardo Habkost 
---
 include/crypto/secret.h | 11 ++-
 crypto/secret.c | 25 +++--
 crypto/secret_common.c  | 27 +--
 crypto/secret_keyring.c | 29 -
 4 files changed, 30 insertions(+), 62 deletions(-)

diff --git a/include/crypto/secret.h b/include/crypto/secret.h
index 5d20ae6d2f..4eb4e5ffef 100644
--- a/include/crypto/secret.h
+++ b/include/crypto/secret.h
@@ -26,11 +26,9 @@
 #include "crypto/secret_common.h"
 
 #define TYPE_QCRYPTO_SECRET "secret"
-typedef struct QCryptoSecret QCryptoSecret;
-DECLARE_INSTANCE_CHECKER(QCryptoSecret, QCRYPTO_SECRET,
- TYPE_QCRYPTO_SECRET)
 
-typedef struct QCryptoSecretClass QCryptoSecretClass;
+OBJECT_DECLARE_SIMPLE_TYPE(QCryptoSecret, qcrypto_secret,
+   QCRYPTO_SECRET, QCryptoSecretCommon)
 
 /**
  * QCryptoSecret:
@@ -125,9 +123,4 @@ struct QCryptoSecret {
 char *file;
 };
 
-
-struct QCryptoSecretClass {
-QCryptoSecretCommonClass parent_class;
-};
-
 #endif /* QCRYPTO_SECRET_H */
diff --git a/crypto/secret.c b/crypto/secret.c
index c07011d388..55b406f79e 100644
--- a/crypto/secret.c
+++ b/crypto/secret.c
@@ -25,6 +25,9 @@
 #include "qemu/module.h"
 #include "trace.h"
 
+OBJECT_DEFINE_TYPE_WITH_INTERFACES(QCryptoSecret, qcrypto_secret,
+   QCRYPTO_SECRET, QCRYPTO_SECRET_COMMON,
+   { TYPE_USER_CREATABLE }, { NULL })
 
 static void
 qcrypto_secret_load_data(QCryptoSecretCommon *sec_common,
@@ -140,21 +143,7 @@ qcrypto_secret_class_init(ObjectClass *oc, void *data)
   qcrypto_secret_prop_set_file);
 }
 
-
-static const TypeInfo qcrypto_secret_info = {
-.parent = TYPE_QCRYPTO_SECRET_COMMON,
-.name = TYPE_QCRYPTO_SECRET,
-.instance_size = sizeof(QCryptoSecret),
-.instance_finalize = qcrypto_secret_finalize,
-.class_size = sizeof(QCryptoSecretClass),
-.class_init = qcrypto_secret_class_init,
-.interfaces = (InterfaceInfo[]) {
-{ TYPE_USER_CREATABLE },
-{ }
-}
-};
-TYPE_INFO(qcrypto_secret_info)
-
-
-
-
+static void
+qcrypto_secret_init(Object *obj)
+{
+}
diff --git a/crypto/secret_common.c b/crypto/secret_common.c
index 80d7d75b4d..9a054b90b5 100644
--- a/crypto/secret_common.c
+++ b/crypto/secret_common.c
@@ -28,6 +28,9 @@
 #include "trace.h"
 
 
+OBJECT_DEFINE_ABSTRACT_TYPE(QCryptoSecretCommon, qcrypto_secret_common,
+QCRYPTO_SECRET_COMMON, OBJECT)
+
 static void qcrypto_secret_decrypt(QCryptoSecretCommon *secret,
const uint8_t *input,
size_t inputlen,
@@ -269,7 +272,7 @@ qcrypto_secret_prop_get_keyid(Object *obj,
 
 
 static void
-qcrypto_secret_finalize(Object *obj)
+qcrypto_secret_common_finalize(Object *obj)
 {
 QCryptoSecretCommon *secret = QCRYPTO_SECRET_COMMON(obj);
 
@@ -279,7 +282,7 @@ qcrypto_secret_finalize(Object *obj)
 }
 
 static void
-qcrypto_secret_class_init(ObjectClass *oc, void *data)
+qcrypto_secret_common_class_init(ObjectClass *oc, void *data)
 {
 object_class_property_add_bool(oc, "loaded",
qcrypto_secret_prop_get_loaded,
@@ -297,6 +300,10 @@ qcrypto_secret_class_init(ObjectClass *oc, void *data)
   qcrypto_secret_prop_set_iv);
 }
 
+static void
+qcrypto_secret_common_init(Object *obj)
+{
+}
 
 int qcrypto_secret_lookup(const char *secretid,
   uint8_t **data,
@@ -380,19 +387,3 @@ char *qcrypto_secret_lookup_as_base64(const char *secretid,
 g_free(data);
 return ret;
 }
-
-
-static const TypeInfo qcrypto_secret_info = {
-.parent = TYPE_OBJECT,
-.name = TYPE_QCRYPTO_SECRET_COMMON,
-.instance_size = sizeof(QCryptoSecretCommon),
-.instance_finalize = qcrypto_secret_finalize,
-.class_size = sizeof(QCryptoSecretCommonClass),
-.class_init = qcrypto_secret_class_init,
-.abstract = true,
-};
-TYPE_INFO(qcrypto_secret_info)
-
-
-
-
diff --git a/crypto/secret_keyring.c b/crypto/secret_keyring.c
index 821d2e421b..463aefe5dc 100644
--- a/crypto/secret_keyring.c
+++ b/crypto/secret_keyring.c
@@ -26,6 +26,9 @@
 #include "trace.h"
 #include "crypto/secret_keyring.h"
 
+OBJECT_DEFINE_TYPE_WITH_INTERFACES(QCryptoSecretKeyring, 
qcrypto_secret_keyring,
+   QCRYPTO_SECRET_KEYRING, 
QCRYPTO_SECRET_COMMON,
+   { TYPE_USER_CREATABLE }, { NULL })
 
 static inline
 long keyctl_read(int32_t key, uint8_t *buffer, size_t buflen)
@@ -109,6 +112,11 @@

[PATCH 41/41] crypto: use QOM macros for declaration/definition of TLS creds types

From: Daniel P. Berrangé 

This introduces the use of the OBJECT_DEFINE and OBJECT_DECLARE macro
families in the TLS creds types, in order to eliminate boilerplate code.

Signed-off-by: Daniel P. Berrangé 
Message-Id: <20200723181410.3145233-5-berra...@redhat.com>
[ehabkost: rebase, update to pass additional arguments to macro]
Signed-off-by: Eduardo Habkost 
---
 include/crypto/tlscreds.h | 13 ++---
 include/crypto/tlscredsanon.h | 14 ++
 include/crypto/tlscredspsk.h  | 13 ++---
 include/crypto/tlscredsx509.h | 13 ++---
 crypto/tlscreds.c | 20 +++-
 crypto/tlscredsanon.c | 24 +++-
 crypto/tlscredspsk.c  | 26 --
 crypto/tlscredsx509.c | 24 
 8 files changed, 30 insertions(+), 117 deletions(-)

diff --git a/include/crypto/tlscreds.h b/include/crypto/tlscreds.h
index 079e376047..e9b9b8c20a 100644
--- a/include/crypto/tlscreds.h
+++ b/include/crypto/tlscreds.h
@@ -29,11 +29,8 @@
 #endif
 
 #define TYPE_QCRYPTO_TLS_CREDS "tls-creds"
-typedef struct QCryptoTLSCreds QCryptoTLSCreds;
-DECLARE_INSTANCE_CHECKER(QCryptoTLSCreds, QCRYPTO_TLS_CREDS,
- TYPE_QCRYPTO_TLS_CREDS)
-
-typedef struct QCryptoTLSCredsClass QCryptoTLSCredsClass;
+OBJECT_DECLARE_SIMPLE_TYPE(QCryptoTLSCreds, qcrypto_tls_creds,
+   QCRYPTO_TLS_CREDS, Object)
 
 #define QCRYPTO_TLS_CREDS_DH_PARAMS "dh-params.pem"
 
@@ -58,10 +55,4 @@ struct QCryptoTLSCreds {
 char *priority;
 };
 
-
-struct QCryptoTLSCredsClass {
-ObjectClass parent_class;
-};
-
-
 #endif /* QCRYPTO_TLSCREDS_H */
diff --git a/include/crypto/tlscredsanon.h b/include/crypto/tlscredsanon.h
index 3f464a3809..338b668b1d 100644
--- a/include/crypto/tlscredsanon.h
+++ b/include/crypto/tlscredsanon.h
@@ -25,12 +25,8 @@
 #include "qom/object.h"
 
 #define TYPE_QCRYPTO_TLS_CREDS_ANON "tls-creds-anon"
-typedef struct QCryptoTLSCredsAnon QCryptoTLSCredsAnon;
-DECLARE_INSTANCE_CHECKER(QCryptoTLSCredsAnon, QCRYPTO_TLS_CREDS_ANON,
- TYPE_QCRYPTO_TLS_CREDS_ANON)
-
-
-typedef struct QCryptoTLSCredsAnonClass QCryptoTLSCredsAnonClass;
+OBJECT_DECLARE_SIMPLE_TYPE(QCryptoTLSCredsAnon, qcrypto_tls_creds_anon,
+   QCRYPTO_TLS_CREDS_ANON, QCryptoTLSCreds)
 
 /**
  * QCryptoTLSCredsAnon:
@@ -103,10 +99,4 @@ struct QCryptoTLSCredsAnon {
 #endif
 };
 
-
-struct QCryptoTLSCredsAnonClass {
-QCryptoTLSCredsClass parent_class;
-};
-
-
 #endif /* QCRYPTO_TLSCREDSANON_H */
diff --git a/include/crypto/tlscredspsk.h b/include/crypto/tlscredspsk.h
index d7e6bdb5ed..16e3f84f47 100644
--- a/include/crypto/tlscredspsk.h
+++ b/include/crypto/tlscredspsk.h
@@ -25,11 +25,8 @@
 #include "qom/object.h"
 
 #define TYPE_QCRYPTO_TLS_CREDS_PSK "tls-creds-psk"
-typedef struct QCryptoTLSCredsPSK QCryptoTLSCredsPSK;
-DECLARE_INSTANCE_CHECKER(QCryptoTLSCredsPSK, QCRYPTO_TLS_CREDS_PSK,
- TYPE_QCRYPTO_TLS_CREDS_PSK)
-
-typedef struct QCryptoTLSCredsPSKClass QCryptoTLSCredsPSKClass;
+OBJECT_DECLARE_SIMPLE_TYPE(QCryptoTLSCredsPSK, qcrypto_tls_creds_psk,
+   QCRYPTO_TLS_CREDS_PSK, QCryptoTLSCreds)
 
 #define QCRYPTO_TLS_CREDS_PSKFILE "keys.psk"
 
@@ -98,10 +95,4 @@ struct QCryptoTLSCredsPSK {
 #endif
 };
 
-
-struct QCryptoTLSCredsPSKClass {
-QCryptoTLSCredsClass parent_class;
-};
-
-
 #endif /* QCRYPTO_TLSCREDSPSK_H */
diff --git a/include/crypto/tlscredsx509.h b/include/crypto/tlscredsx509.h
index c6d89b7881..1197f33663 100644
--- a/include/crypto/tlscredsx509.h
+++ b/include/crypto/tlscredsx509.h
@@ -25,11 +25,8 @@
 #include "qom/object.h"
 
 #define TYPE_QCRYPTO_TLS_CREDS_X509 "tls-creds-x509"
-typedef struct QCryptoTLSCredsX509 QCryptoTLSCredsX509;
-DECLARE_INSTANCE_CHECKER(QCryptoTLSCredsX509, QCRYPTO_TLS_CREDS_X509,
- TYPE_QCRYPTO_TLS_CREDS_X509)
-
-typedef struct QCryptoTLSCredsX509Class QCryptoTLSCredsX509Class;
+OBJECT_DECLARE_SIMPLE_TYPE(QCryptoTLSCredsX509, qcrypto_tls_creds_x509,
+   QCRYPTO_TLS_CREDS_X509, QCryptoTLSCreds)
 
 #define QCRYPTO_TLS_CREDS_X509_CA_CERT "ca-cert.pem"
 #define QCRYPTO_TLS_CREDS_X509_CA_CRL "ca-crl.pem"
@@ -105,10 +102,4 @@ struct QCryptoTLSCredsX509 {
 char *passwordid;
 };
 
-
-struct QCryptoTLSCredsX509Class {
-QCryptoTLSCredsClass parent_class;
-};
-
-
 #endif /* QCRYPTO_TLSCREDSX509_H */
diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index bb3e6667b9..c238ff7d4b 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -24,6 +24,9 @@
 #include "tlscredspriv.h"
 #include "trace.h"
 
+OBJECT_DEFINE_ABSTRACT_TYPE(QCryptoTLSCreds, qcrypto_tls_creds,
+QCRYPTO_TLS_CREDS, OBJECT)
+
 #define DH_BITS 2048
 
 #ifdef CONFIG_GNUTLS
@@ -258,20 +261,3 @@ qcrypto_tls_creds_finalize(Object *obj)
 g_free(creds->dir);
 g_free(creds->priority);
 }
-
-
-static const TypeInfo qcrypto_tls_creds_info = {
-

[PATCH 31/41] qom: TYPE_INFO macro

Provide a TYPE_INFO macro that can be used to register a TypeInfo
struct declaratively.  This will allow QOM type registration to
be 100% declarative.

Signed-off-by: Eduardo Habkost 
---
 include/qom/object.h | 15 +--
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index 1d6a520d35..81bea3b4ed 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -655,6 +655,14 @@ struct Object
 struct InstanceType##Class { ParentClassType parent_class; };
 
 
+#define TYPE_INFO(type_info_var) \
+static void \
+register_type_info_##type_info_var(void) \
+{ \
+type_register_static(_info_var); \
+} \
+type_init(register_type_info_##type_info_var);
+
 /**
  * OBJECT_DEFINE_TYPE_EXTENDED:
  * @ModuleObjName: the object name with initial caps
@@ -700,12 +708,7 @@ struct Object
 .interfaces = (InterfaceInfo[]) { __VA_ARGS__ } , \
 }; \
 \
-static void \
-module_obj_name##_register_types(void) \
-{ \
-type_register_static(_obj_name##_info); \
-} \
-type_init(module_obj_name##_register_types);
+TYPE_INFO(module_obj_name##_info)
 
 /**
  * OBJECT_DEFINE_TYPE:
-- 
2.26.2

[PATCH 30/41] qom: Make type checker functions accept const pointers

The existing type check macros all unconditionally drop const
qualifiers from their arguments.  Keep this behavior in the
macros generated by DECLARE_*CHECKER* by now.

In the future, we might use _Generic to preserve const-ness of
the cast function arguments.

Signed-off-by: Eduardo Habkost 
---
 include/qom/object.h | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index 4cd84998c2..1d6a520d35 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -567,7 +567,7 @@ struct Object
  */
 #define DECLARE_INSTANCE_CHECKER(InstanceType, OBJ_NAME, TYPENAME) \
 static inline G_GNUC_UNUSED InstanceType * \
-OBJ_NAME(void *obj) \
+OBJ_NAME(const void *obj) \
 { return OBJECT_CHECK(InstanceType, obj, TYPENAME); }
 
 /**
@@ -581,14 +581,16 @@ struct Object
  *
  * This macro will provide the three standard type cast functions for a
  * QOM type.
+ *
+ *FIXME: Use _Generic to make this const-safe
  */
 #define DECLARE_CLASS_CHECKERS(ClassType, OBJ_NAME, TYPENAME) \
 static inline G_GNUC_UNUSED ClassType * \
-OBJ_NAME##_GET_CLASS(void *obj) \
+OBJ_NAME##_GET_CLASS(const void *obj) \
 { return OBJECT_GET_CLASS(ClassType, obj, TYPENAME); } \
 \
 static inline G_GNUC_UNUSED ClassType * \
-OBJ_NAME##_CLASS(void *klass) \
+OBJ_NAME##_CLASS(const void *klass) \
 { return OBJECT_CLASS_CHECK(ClassType, klass, TYPENAME); }
 
 /**
-- 
2.26.2

[PATCH 39/41] [automated] Use OBJECT_DECLARE_SIMPLE_TYPE when possible

Generated using:

 $ ./scripts/codeconverter/converter.py -i \
   --pattern=ObjectDeclareType $(git grep -l '' -- '*.[ch]')

Signed-off-by: Eduardo Habkost 
---
 include/authz/list.h| 7 ++-
 include/authz/listfile.h| 7 ++-
 include/authz/pamacct.h | 7 ++-
 include/authz/simple.h  | 7 ++-
 include/crypto/secret_keyring.h | 7 ++-
 include/io/dns-resolver.h   | 7 ++-
 include/io/net-listener.h   | 7 ++-
 include/sysemu/vhost-user-backend.h | 7 ++-
 backends/dbus-vmstate.c | 7 ++-
 ui/input-barrier.c  | 7 ++-
 ui/input-linux.c| 7 ++-
 11 files changed, 22 insertions(+), 55 deletions(-)

diff --git a/include/authz/list.h b/include/authz/list.h
index e4e1040472..5676bb375c 100644
--- a/include/authz/list.h
+++ b/include/authz/list.h
@@ -27,8 +27,8 @@
 
 #define TYPE_QAUTHZ_LIST "authz-list"
 
-OBJECT_DECLARE_TYPE(QAuthZList, QAuthZListClass,
-qauthz_list, QAUTHZ_LIST)
+OBJECT_DECLARE_SIMPLE_TYPE(QAuthZList, qauthz_list,
+   QAUTHZ_LIST, QAuthZClass)
 
 
 
@@ -68,9 +68,6 @@ struct QAuthZList {
 };
 
 
-struct QAuthZListClass {
-QAuthZClass parent_class;
-};
 
 
 QAuthZList *qauthz_list_new(const char *id,
diff --git a/include/authz/listfile.h b/include/authz/listfile.h
index 89c5eafbfa..b491227bbe 100644
--- a/include/authz/listfile.h
+++ b/include/authz/listfile.h
@@ -27,8 +27,8 @@
 
 #define TYPE_QAUTHZ_LIST_FILE "authz-list-file"
 
-OBJECT_DECLARE_TYPE(QAuthZListFile, QAuthZListFileClass,
-qauthz_list_file, QAUTHZ_LIST_FILE)
+OBJECT_DECLARE_SIMPLE_TYPE(QAuthZListFile, qauthz_list_file,
+   QAUTHZ_LIST_FILE, QAuthZClass)
 
 
 
@@ -87,9 +87,6 @@ struct QAuthZListFile {
 };
 
 
-struct QAuthZListFileClass {
-QAuthZClass parent_class;
-};
 
 
 QAuthZListFile *qauthz_list_file_new(const char *id,
diff --git a/include/authz/pamacct.h b/include/authz/pamacct.h
index 44bb5ff28d..7804853ddf 100644
--- a/include/authz/pamacct.h
+++ b/include/authz/pamacct.h
@@ -27,8 +27,8 @@
 
 #define TYPE_QAUTHZ_PAM "authz-pam"
 
-OBJECT_DECLARE_TYPE(QAuthZPAM, QAuthZPAMClass,
-qauthz_pam, QAUTHZ_PAM)
+OBJECT_DECLARE_SIMPLE_TYPE(QAuthZPAM, qauthz_pam,
+   QAUTHZ_PAM, QAuthZClass)
 
 
 
@@ -79,9 +79,6 @@ struct QAuthZPAM {
 };
 
 
-struct QAuthZPAMClass {
-QAuthZClass parent_class;
-};
 
 
 QAuthZPAM *qauthz_pam_new(const char *id,
diff --git a/include/authz/simple.h b/include/authz/simple.h
index ba4a5ec5ea..346fcb0c6c 100644
--- a/include/authz/simple.h
+++ b/include/authz/simple.h
@@ -26,8 +26,8 @@
 
 #define TYPE_QAUTHZ_SIMPLE "authz-simple"
 
-OBJECT_DECLARE_TYPE(QAuthZSimple, QAuthZSimpleClass,
-qauthz_simple, QAUTHZ_SIMPLE)
+OBJECT_DECLARE_SIMPLE_TYPE(QAuthZSimple, qauthz_simple,
+   QAUTHZ_SIMPLE, QAuthZClass)
 
 
 
@@ -62,9 +62,6 @@ struct QAuthZSimple {
 };
 
 
-struct QAuthZSimpleClass {
-QAuthZClass parent_class;
-};
 
 
 QAuthZSimple *qauthz_simple_new(const char *id,
diff --git a/include/crypto/secret_keyring.h b/include/crypto/secret_keyring.h
index cc2c7397db..73d2a8f501 100644
--- a/include/crypto/secret_keyring.h
+++ b/include/crypto/secret_keyring.h
@@ -26,8 +26,8 @@
 #include "crypto/secret_common.h"
 
 #define TYPE_QCRYPTO_SECRET_KEYRING "secret_keyring"
-OBJECT_DECLARE_TYPE(QCryptoSecretKeyring, QCryptoSecretKeyringClass,
-qcrypto_secret_keyring, QCRYPTO_SECRET_KEYRING)
+OBJECT_DECLARE_SIMPLE_TYPE(QCryptoSecretKeyring, qcrypto_secret_keyring,
+   QCRYPTO_SECRET_KEYRING, QCryptoSecretCommonClass)
 
 
 struct QCryptoSecretKeyring {
@@ -36,8 +36,5 @@ struct QCryptoSecretKeyring {
 };
 
 
-struct QCryptoSecretKeyringClass {
-QCryptoSecretCommonClass parent;
-};
 
 #endif /* QCRYPTO_SECRET_KEYRING_H */
diff --git a/include/io/dns-resolver.h b/include/io/dns-resolver.h
index 8ae4857e05..e248fba5bd 100644
--- a/include/io/dns-resolver.h
+++ b/include/io/dns-resolver.h
@@ -26,8 +26,8 @@
 #include "io/task.h"
 
 #define TYPE_QIO_DNS_RESOLVER "qio-dns-resolver"
-OBJECT_DECLARE_TYPE(QIODNSResolver, QIODNSResolverClass,
-qio_dns_resolver, QIO_DNS_RESOLVER)
+OBJECT_DECLARE_SIMPLE_TYPE(QIODNSResolver, qio_dns_resolver,
+   QIO_DNS_RESOLVER, ObjectClass)
 
 
 /**
@@ -133,9 +133,6 @@ struct QIODNSResolver {
 Object parent;
 };
 
-struct QIODNSResolverClass {
-ObjectClass parent;
-};
 
 
 /**
diff --git a/include/io/net-listener.h b/include/io/net-listener.h
index 4f0847ff19..60fad29ff4 100644
--- a/include/io/net-listener.h
+++ b/include/io/net-listener.h
@@ -25,8 +25,8 @@
 #include "qom/object.h"
 
 #define TYPE_QIO_NET_LISTENER "qio-net-listener"
-OBJECT_DECLARE_TYPE(QIONetListener, QIONetListenerClass,
-qio_net_listener, QIO_NET_LISTENER)

[PATCH 26/41] qom: provide convenient macros for declaring and defining types

From: Daniel P. Berrangé 

When creating new QOM types, there is a lot of boilerplate code that
must be repeated using a standard pattern. This is tedious to write
and liable to suffer from subtle inconsistencies. Thus it would
benefit from some simple automation.

QOM was loosely inspired by GLib's GObject, and indeed GObject suffers
from the same burden of boilerplate code, but has long provided a set of
macros to eliminate this burden in the source implementation. More
recently it has also provided a set of macros to eliminate this burden
in the header declaration.

In GLib there are the G_DECLARE_* and G_DEFINE_* family of macros
for the header declaration and source implementation respectively:

  https://developer.gnome.org/gobject/stable/chapter-gobject.html
  https://developer.gnome.org/gobject/stable/howto-gobject.html

This patch takes inspiration from GObject to provide the equivalent
functionality for QOM.

In the header file, instead of:

typedef struct MyDevice MyDevice;
typedef struct MyDeviceClass MyDeviceClass;

G_DEFINE_AUTOPTR_CLEANUP_FUNC(MyDeviceClass, object_unref)

#define MY_DEVICE_GET_CLASS(void *obj) \
OBJECT_GET_CLASS(MyDeviceClass, obj, TYPE_MY_DEVICE)
#define MY_DEVICE_CLASS(void *klass) \
OBJECT_CLASS_CHECK(MyDeviceClass, klass, TYPE_MY_DEVICE)
#define MY_DEVICE(void *obj)
OBJECT_CHECK(MyDevice, obj, TYPE_MY_DEVICE)

struct MyDeviceClass {
DeviceClass parent_class;
};

We now have

OBJECT_DECLARE_SIMPLE_TYPE(MyDevice, my_device, MY_DEVICE, DEVICE)

In cases where the class needs some virtual methods, it can be left
to be implemented manually using

OBJECT_DECLARE_TYPE(MyDevice, my_device, MY_DEVICE)

Note that these macros are including support for g_autoptr() for the
object types, which is something previously only supported for variables
declared as the base Object * type.

Meanwhile in the source file, instead of:

static void my_device_finalize(Object *obj);
static void my_device_class_init(ObjectClass *oc, void *data);
static void my_device_init(Object *obj);

static const TypeInfo my_device_info = {
.parent = TYPE_DEVICE,
.name = TYPE_MY_DEVICE,
.instance_size = sizeof(MyDevice),
.instance_init = my_device_init,
.instance_finalize = my_device_finalize,
.class_size = sizeof(MyDeviceClass),
.class_init = my_device_class_init,
};

static void
my_device_register_types(void)
{
type_register_static(_device_info);
}
type_init(my_device_register_types);

We now have

OBJECT_DEFINE_TYPE(MyDevice, my_device, MY_DEVICE, DEVICE)

Or, if a class needs to implement interfaces:

OBJECT_DEFINE_TYPE_WITH_INTERFACES(MyDevice, my_device, MY_DEVICE, DEVICE,
   { TYPE_USER_CREATABLE }, { NULL })

Or, if a class needs to be abstract

OBJECT_DEFINE_ABSTRACT_TYPE(MyDevice, my_device, MY_DEVICE, DEVICE)

IOW, in both cases the maintainer now only has to think about the
interesting part of the code which implements useful functionality
and avoids much of the boilerplate.

Signed-off-by: Daniel P. Berrangé 
Message-Id: <20200723181410.3145233-3-berra...@redhat.com>
---
 include/qom/object.h | 277 +++
 1 file changed, 277 insertions(+)

diff --git a/include/qom/object.h b/include/qom/object.h
index 1f8aa2d48e..be64421089 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -304,6 +304,119 @@ typedef struct InterfaceInfo InterfaceInfo;
  *
  * The first example of such a QOM method was #CPUClass.reset,
  * another example is #DeviceClass.realize.
+ *
+ * # Standard type declaration and definition macros #
+ *
+ * A lot of the code outlined above follows a standard pattern and naming
+ * convention. To reduce the amount of boilerplate code that needs to be
+ * written for a new type there are two sets of macros to generate the
+ * common parts in a standard format.
+ *
+ * A type is declared using the OBJECT_DECLARE macro family. In types
+ * which do not require any virtual functions in the class, the
+ * OBJECT_DECLARE_SIMPLE_TYPE macro is suitable, and is commonly placed
+ * in the header file:
+ *
+ * 
+ *   Declaring a simple type
+ *   
+ * OBJECT_DECLARE_SIMPLE_TYPE(MyDevice, my_device, MY_DEVICE, DEVICE)
+ *   
+ * 
+ *
+ * This is equivalent to the following:
+ *
+ * 
+ *   Expansion from declaring a simple type
+ *   
+ * typedef struct MyDevice MyDevice;
+ * typedef struct MyDeviceClass MyDeviceClass;
+ *
+ * G_DEFINE_AUTOPTR_CLEANUP_FUNC(MyDeviceClass, object_unref)
+ *
+ * #define MY_DEVICE_GET_CLASS(void *obj) \
+ * OBJECT_GET_CLASS(MyDeviceClass, obj, TYPE_MY_DEVICE)
+ * #define MY_DEVICE_CLASS(void *klass) \
+ * OBJECT_CLASS_CHECK(MyDeviceClass, klass, TYPE_MY_DEVICE)
+ * #define MY_DEVICE(void *obj)
+ * OBJECT_CHECK(MyDevice, obj,

[PATCH 29/41] qom: DECLARE_*_CHECKERS macros

Sometimes the typedefs are buried inside another header, but
we want to benefit from the automatic definition of type cast
functions.  Introduce macros that will let type checkers be
defined when typedefs are already available.

Signed-off-by: Eduardo Habkost 
---
 include/qom/object.h | 72 +++-
 1 file changed, 58 insertions(+), 14 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index 500e7dfa99..4cd84998c2 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -553,6 +553,62 @@ struct Object
 Object *parent;
 };
 
+/**
+ * DECLARE_INSTANCE_CHECKER:
+ * @InstanceType: instance struct name
+ * @OBJ_NAME: the object name in uppercase with underscore separators
+ * @TYPENAME: type name
+ *
+ * Direct usage of this macro should be avoided, and the complete
+ * OBJECT_DECLARE_TYPE macro is recommended instead.
+ *
+ * This macro will provide the three standard type cast functions for a
+ * QOM type.
+ */
+#define DECLARE_INSTANCE_CHECKER(InstanceType, OBJ_NAME, TYPENAME) \
+static inline G_GNUC_UNUSED InstanceType * \
+OBJ_NAME(void *obj) \
+{ return OBJECT_CHECK(InstanceType, obj, TYPENAME); }
+
+/**
+ * DECLARE_CLASS_CHECKERS:
+ * @ClassType: class struct name
+ * @OBJ_NAME: the object name in uppercase with underscore separators
+ * @TYPENAME: type name
+ *
+ * Direct usage of this macro should be avoided, and the complete
+ * OBJECT_DECLARE_TYPE macro is recommended instead.
+ *
+ * This macro will provide the three standard type cast functions for a
+ * QOM type.
+ */
+#define DECLARE_CLASS_CHECKERS(ClassType, OBJ_NAME, TYPENAME) \
+static inline G_GNUC_UNUSED ClassType * \
+OBJ_NAME##_GET_CLASS(void *obj) \
+{ return OBJECT_GET_CLASS(ClassType, obj, TYPENAME); } \
+\
+static inline G_GNUC_UNUSED ClassType * \
+OBJ_NAME##_CLASS(void *klass) \
+{ return OBJECT_CLASS_CHECK(ClassType, klass, TYPENAME); }
+
+/**
+ * DECLARE_OBJ_CHECKERS:
+ * @InstanceType: instance struct name
+ * @ClassType: class struct name
+ * @OBJ_NAME: the object name in uppercase with underscore separators
+ * @TYPENAME: type name
+ *
+ * Direct usage of this macro should be avoided, and the complete
+ * OBJECT_DECLARE_TYPE macro is recommended instead.
+ *
+ * This macro will provide the three standard type cast functions for a
+ * QOM type.
+ */
+#define DECLARE_OBJ_CHECKERS(InstanceType, ClassType, OBJ_NAME, TYPENAME) \
+DECLARE_INSTANCE_CHECKER(InstanceType, OBJ_NAME, TYPENAME) \
+\
+DECLARE_CLASS_CHECKERS(ClassType, OBJ_NAME, TYPENAME)
+
 /**
  * OBJECT_DECLARE_TYPE:
  * @InstanceType: instance struct name
@@ -574,20 +630,8 @@ struct Object
 \
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(InstanceType, object_unref) \
 \
-static inline G_GNUC_UNUSED ClassType * \
-MODULE_OBJ_NAME##_GET_CLASS(void *obj) \
-{ return OBJECT_GET_CLASS(ClassType, obj, \
-  TYPE_##MODULE_OBJ_NAME); } \
-\
-static inline G_GNUC_UNUSED ClassType * \
-MODULE_OBJ_NAME##_CLASS(void *klass) \
-{ return OBJECT_CLASS_CHECK(ClassType, klass, \
-TYPE_##MODULE_OBJ_NAME); } \
-\
-static inline G_GNUC_UNUSED InstanceType * \
-MODULE_OBJ_NAME(void *obj) \
-{ return OBJECT_CHECK(InstanceType, obj, \
-  TYPE_##MODULE_OBJ_NAME); }
+DECLARE_OBJ_CHECKERS(InstanceType, ClassType, \
+ MODULE_OBJ_NAME, TYPE_##MODULE_OBJ_NAME)
 
 /**
  * OBJECT_DECLARE_SIMPLE_TYPE:
-- 
2.26.2

[PATCH 27/41] qom: Fix G_DEFINE_AUTOPTR_CLEANUP_FUNC

ModuleObjName##Class was being used instead of ModuleObjName.
Fix it.

Signed-off-by: Eduardo Habkost 
---
 include/qom/object.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index be64421089..f515230f61 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -571,7 +571,7 @@ struct Object
 typedef struct ModuleObjName ModuleObjName; \
 typedef struct ModuleObjName##Class ModuleObjName##Class; \
 \
-G_DEFINE_AUTOPTR_CLEANUP_FUNC(ModuleObjName##Class, object_unref) \
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(ModuleObjName, object_unref) \
 \
 static inline G_GNUC_UNUSED ModuleObjName##Class * \
 MODULE_OBJ_NAME##_GET_CLASS(void *obj) \
-- 
2.26.2

[Bug 1886076] Re: risc-v pmp implementation error

This should be fixed once the current RISC-V branch is merged into
master.

You can see the patch that fixes this here:
https://patchew.org/QEMU/20200812223045.96803-1-alistair.fran...@wdc.com/20200812223045.96803-18-alistair.fran...@wdc.com/

** Changed in: qemu
Assignee: (unassigned) => Alistair Francis (alistair2323)

--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1886076

Title:
risc-v pmp implementation error

Status in QEMU:
Fix Committed

Bug description:
QEMU Commit fc1bff958998910ec8d25db86cd2f53ff125f7ab

RISC-V PMP implementation is not correct on QEMU.

When an access is granted there is no more PMP check on the 4KB memory range
of the accessed location.
A cache flush is needed in order to force a PMP check on next access to this
4KB memory range.
A correct implementation would be to grant access to the maximum allowed area
around the accessed location within the 4KB memory range.

For instance, if PMP is configured to block all accesses from 0x80003000 to
0x800037FF and from 0x80003C00 to 0x80003FFF:
1st case:
1) A read access is done @0x80003900 --> access OK as expected
2) Then a read access is done @0x80003400 --> access OK while it must be
blocked!
2nd case:
1) A read access is done @0x80003900 --> access OK as expected
2) Cache is flushed (__asm__ __volatile__ ("sfence.vma" : : : "memory");)

3) A read access is done @0x80003400 --> access blocked as expected

Analysis:
After the 1st read @0x80003900 QEMU add the memory range 0x80003000 to
0x80003FFF into a TLB entry.
Then no more PMP check is done from 0x80003000 to 0x80003FFF until the
TLB is flushed.
What should be done:
Only the range 0x80003800 to 0x80003BFF should be added to the TLB entry.

The 4KB range is the default size of a TLB page on QEMU for RISCV.
The minimum size that can be set is 64Bytes. However the PMP granularity can
be as low as 4Bytes.

I tested a quick fix and PMP is working as expected.
The quick fix consist in replacing this line:
tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK, prot,
mmu_idx, TARGET_PAGE_SIZE);
By this one in target/riscv/cpu_helper.c:
tlb_set_page(cs, address & ~0x3, pa & ~0x3, prot, mmu_idx, size);

This quick fix has to be optimized in order to consume less HW
resources, as explained at the beginning.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1886076/+subscriptions

[PATCH 25/41] qom: make object_ref/unref use a void * instead of Object *.

From: Daniel P. Berrangé 

The object_ref/unref methods are intended for use with any subclass of
the base Object. Using "Object *" in the signature is not adding any
meaningful level of type safety, since callers simply use "OBJECT(ptr)"
and this expands to an unchecked cast "(Object *)".

By using "void *" we enable the object_unref() method to be used to
provide support for g_autoptr() with any subclass.

Signed-off-by: Daniel P. Berrangé 
Message-Id: <20200723181410.3145233-2-berra...@redhat.com>
---
 include/qom/object.h | 4 ++--
 qom/object.c | 6 --
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/qom/object.h b/include/qom/object.h
index 0f3a60617c..1f8aa2d48e 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -1035,7 +1035,7 @@ GSList *object_class_get_list_sorted(const char 
*implements_type,
  * as its reference count is greater than zero.
  * Returns: @obj
  */
-Object *object_ref(Object *obj);
+Object *object_ref(void *obj);
 
 /**
  * object_unref:
@@ -1044,7 +1044,7 @@ Object *object_ref(Object *obj);
  * Decrease the reference count of a object.  A object cannot be freed as long
  * as its reference count is greater than zero.
  */
-void object_unref(Object *obj);
+void object_unref(void *obj);
 
 /**
  * object_property_try_add:
diff --git a/qom/object.c b/qom/object.c
index 00fdf89b3b..b1822a2ef4 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1124,8 +1124,9 @@ GSList *object_class_get_list_sorted(const char 
*implements_type,
 object_class_cmp);
 }
 
-Object *object_ref(Object *obj)
+Object *object_ref(void *objptr)
 {
+Object *obj = OBJECT(objptr);
 if (!obj) {
 return NULL;
 }
@@ -1133,8 +1134,9 @@ Object *object_ref(Object *obj)
 return obj;
 }
 
-void object_unref(Object *obj)
+void object_unref(void *objptr)
 {
+Object *obj = OBJECT(objptr);
 if (!obj) {
 return;
 }
-- 
2.26.2

[PATCH 22/41] can_emu: Delete macros for non-existing typedef

CanBusClass doesn't exist.  This will break when we automatically
convert the code to use OBJECT_DEFINE_TYPE().  Delete the macros
that reference the non-existing typedef.

Signed-off-by: Eduardo Habkost 
---
 include/net/can_emu.h | 4 
 1 file changed, 4 deletions(-)

diff --git a/include/net/can_emu.h b/include/net/can_emu.h
index fce9770928..7e90fd8a45 100644
--- a/include/net/can_emu.h
+++ b/include/net/can_emu.h
@@ -100,10 +100,6 @@ struct CanBusClientState {
 };
 
 #define TYPE_CAN_BUS "can-bus"
-#define CAN_BUS_CLASS(klass) \
- OBJECT_CLASS_CHECK(CanBusClass, (klass), TYPE_CAN_BUS)
-#define CAN_BUS_GET_CLASS(obj) \
- OBJECT_GET_CLASS(CanBusClass, (obj), TYPE_CAN_BUS)
 #define CAN_BUS(obj) \
  OBJECT_CHECK(CanBusState, (obj), TYPE_CAN_BUS)
 
-- 
2.26.2

[PATCH 23/41] nubus: Delete unused NUBUS_BRIDGE macro

The macro never worked because the NubusBridge typedef doesn't
exist.  Delete it.

Signed-off-by: Eduardo Habkost 
---
 include/hw/nubus/nubus.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/hw/nubus/nubus.h b/include/hw/nubus/nubus.h
index a8634e54c5..c350948262 100644
--- a/include/hw/nubus/nubus.h
+++ b/include/hw/nubus/nubus.h
@@ -29,7 +29,6 @@
 #define NUBUS_BUS(obj) OBJECT_CHECK(NubusBus, (obj), TYPE_NUBUS_BUS)
 
 #define TYPE_NUBUS_BRIDGE "nubus-bridge"
-#define NUBUS_BRIDGE(obj) OBJECT_CHECK(NubusBridge, (obj), TYPE_NUBUS_BRIDGE)
 
 typedef struct NubusBus {
 BusState qbus;
-- 
2.26.2

[PATCH 20/41] mcf_fec: Move mcf_fec_state typedef to header

Move typedef closer to the type check macros, to make it easier
to convert the code to OBJECT_DEFINE_TYPE() in the future.

Signed-off-by: Eduardo Habkost 
---
 include/hw/m68k/mcf_fec.h | 1 +
 hw/net/mcf_fec.c  | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/hw/m68k/mcf_fec.h b/include/hw/m68k/mcf_fec.h
index eeb471f9c9..c09e33a57c 100644
--- a/include/hw/m68k/mcf_fec.h
+++ b/include/hw/m68k/mcf_fec.h
@@ -11,6 +11,7 @@
 #define HW_M68K_MCF_FEC_H
 
 #define TYPE_MCF_FEC_NET "mcf-fec"
+typedef struct mcf_fec_state mcf_fec_state;
 #define MCF_FEC_NET(obj) OBJECT_CHECK(mcf_fec_state, (obj), TYPE_MCF_FEC_NET)
 
 #define FEC_NUM_IRQ 13
diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c
index 281345862c..25e3e453ab 100644
--- a/hw/net/mcf_fec.c
+++ b/hw/net/mcf_fec.c
@@ -32,7 +32,7 @@ do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0)
 #define FEC_MAX_FRAME_SIZE 2032
 #define FEC_MIB_SIZE 64
 
-typedef struct {
+struct mcf_fec_state {
 SysBusDevice parent_obj;
 
 MemoryRegion iomem;
@@ -56,7 +56,7 @@ typedef struct {
 uint32_t etdsr;
 uint32_t emrbr;
 uint32_t mib[FEC_MIB_SIZE];
-} mcf_fec_state;
+};
 
 #define FEC_INT_HB   0x8000
 #define FEC_INT_BABR 0x4000
-- 
2.26.2

[PATCH 21/41] s390_flic: Move KVMS390FLICState typedef to header

Move typedef closer to the type check macros, to make it easier
to convert the code to OBJECT_DEFINE_TYPE() in the future.

Signed-off-by: Eduardo Habkost 
---
 include/hw/s390x/s390_flic.h | 1 +
 hw/intc/s390_flic_kvm.c  | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/hw/s390x/s390_flic.h b/include/hw/s390x/s390_flic.h
index 4687ecfe83..df11de9b20 100644
--- a/include/hw/s390x/s390_flic.h
+++ b/include/hw/s390x/s390_flic.h
@@ -75,6 +75,7 @@ typedef struct S390FLICStateClass {
 } S390FLICStateClass;
 
 #define TYPE_KVM_S390_FLIC "s390-flic-kvm"
+typedef struct KVMS390FLICState KVMS390FLICState;
 #define KVM_S390_FLIC(obj) \
 OBJECT_CHECK(KVMS390FLICState, (obj), TYPE_KVM_S390_FLIC)
 
diff --git a/hw/intc/s390_flic_kvm.c b/hw/intc/s390_flic_kvm.c
index a306b26faa..dbd4e682ce 100644
--- a/hw/intc/s390_flic_kvm.c
+++ b/hw/intc/s390_flic_kvm.c
@@ -29,12 +29,12 @@
 #define FLIC_FAILED (-1UL)
 #define FLIC_SAVEVM_VERSION 1
 
-typedef struct KVMS390FLICState {
+struct KVMS390FLICState{
 S390FLICState parent_obj;
 
 uint32_t fd;
 bool clear_io_supported;
-} KVMS390FLICState;
+};
 
 static KVMS390FLICState *s390_get_kvm_flic(S390FLICState *fs)
 {
-- 
2.26.2

[PATCH 17/41] pci: Move PCIBusClass typedef to pci.h

Move typedef closer to the type check macros, to make it easier
to convert the code to OBJECT_DEFINE_TYPE() in the future.

Signed-off-by: Eduardo Habkost 
---
 include/hw/pci/pci.h | 1 +
 include/hw/pci/pci_bus.h | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index c1bf7d5356..4ca7258b5b 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -396,6 +396,7 @@ typedef int (*pci_map_irq_fn)(PCIDevice *pci_dev, int 
irq_num);
 typedef PCIINTxRoute (*pci_route_irq_fn)(void *opaque, int pin);
 
 #define TYPE_PCI_BUS "PCI"
+typedef struct PCIBusClass PCIBusClass;
 #define PCI_BUS(obj) OBJECT_CHECK(PCIBus, (obj), TYPE_PCI_BUS)
 #define PCI_BUS_CLASS(klass) OBJECT_CLASS_CHECK(PCIBusClass, (klass), 
TYPE_PCI_BUS)
 #define PCI_BUS_GET_CLASS(obj) OBJECT_GET_CLASS(PCIBusClass, (obj), 
TYPE_PCI_BUS)
diff --git a/include/hw/pci/pci_bus.h b/include/hw/pci/pci_bus.h
index 0714f578af..347440d42c 100644
--- a/include/hw/pci/pci_bus.h
+++ b/include/hw/pci/pci_bus.h
@@ -10,14 +10,14 @@
  * use accessor functions in pci.h
  */
 
-typedef struct PCIBusClass {
+struct PCIBusClass {
 /*< private >*/
 BusClass parent_class;
 /*< public >*/
 
 int (*bus_num)(PCIBus *bus);
 uint16_t (*numa_node)(PCIBus *bus);
-} PCIBusClass;
+};
 
 enum PCIBusFlags {
 /* This bus is the root of a PCI domain */
-- 
2.26.2

[PATCH 10/41] sifive_u: Rename memmap enum constants

Some of the enum constant names conflict with the QOM type check
macros.  This needs to be addressed to allow us to transform the
QOM type check macros into functions generated by
OBJECT_DECLARE_TYPE().

Rename all the constants to SIFIVE_U_DEV_*, to avoid conflicts.

Signed-off-by: Eduardo Habkost 
---
 include/hw/riscv/sifive_u.h |  30 
 hw/riscv/sifive_u.c | 136 ++--
 2 files changed, 83 insertions(+), 83 deletions(-)

diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index aba4d0181f..0dab922f3a 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -68,21 +68,21 @@ typedef struct SiFiveUState {
 } SiFiveUState;
 
 enum {
-SIFIVE_U_DEBUG,
-SIFIVE_U_MROM,
-SIFIVE_U_CLINT,
-SIFIVE_U_L2LIM,
-SIFIVE_U_PLIC,
-SIFIVE_U_PRCI,
-SIFIVE_U_UART0,
-SIFIVE_U_UART1,
-SIFIVE_U_GPIO,
-SIFIVE_U_OTP,
-SIFIVE_U_DMC,
-SIFIVE_U_FLASH0,
-SIFIVE_U_DRAM,
-SIFIVE_U_GEM,
-SIFIVE_U_GEM_MGMT
+SIFIVE_U_DEV_DEBUG,
+SIFIVE_U_DEV_MROM,
+SIFIVE_U_DEV_CLINT,
+SIFIVE_U_DEV_L2LIM,
+SIFIVE_U_DEV_PLIC,
+SIFIVE_U_DEV_PRCI,
+SIFIVE_U_DEV_UART0,
+SIFIVE_U_DEV_UART1,
+SIFIVE_U_DEV_GPIO,
+SIFIVE_U_DEV_OTP,
+SIFIVE_U_DEV_DMC,
+SIFIVE_U_DEV_FLASH0,
+SIFIVE_U_DEV_DRAM,
+SIFIVE_U_DEV_GEM,
+SIFIVE_U_DEV_GEM_MGMT
 };
 
 enum {
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index e5682c38a9..0dfbcb5160 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -69,21 +69,21 @@ static const struct MemmapEntry {
 hwaddr base;
 hwaddr size;
 } sifive_u_memmap[] = {
-[SIFIVE_U_DEBUG] ={0x0,  0x100 },
-[SIFIVE_U_MROM] = { 0x1000, 0xf000 },
-[SIFIVE_U_CLINT] ={  0x200,0x1 },
-[SIFIVE_U_L2LIM] ={  0x800,  0x200 },
-[SIFIVE_U_PLIC] = {  0xc00,  0x400 },
-[SIFIVE_U_PRCI] = { 0x1000, 0x1000 },
-[SIFIVE_U_UART0] ={ 0x1001, 0x1000 },
-[SIFIVE_U_UART1] ={ 0x10011000, 0x1000 },
-[SIFIVE_U_GPIO] = { 0x1006, 0x1000 },
-[SIFIVE_U_OTP] =  { 0x1007, 0x1000 },
-[SIFIVE_U_GEM] =  { 0x1009, 0x2000 },
-[SIFIVE_U_GEM_MGMT] = { 0x100a, 0x1000 },
-[SIFIVE_U_DMC] =  { 0x100b,0x1 },
-[SIFIVE_U_FLASH0] =   { 0x2000, 0x1000 },
-[SIFIVE_U_DRAM] = { 0x8000,0x0 },
+[SIFIVE_U_DEV_DEBUG] ={0x0,  0x100 },
+[SIFIVE_U_DEV_MROM] = { 0x1000, 0xf000 },
+[SIFIVE_U_DEV_CLINT] ={  0x200,0x1 },
+[SIFIVE_U_DEV_L2LIM] ={  0x800,  0x200 },
+[SIFIVE_U_DEV_PLIC] = {  0xc00,  0x400 },
+[SIFIVE_U_DEV_PRCI] = { 0x1000, 0x1000 },
+[SIFIVE_U_DEV_UART0] ={ 0x1001, 0x1000 },
+[SIFIVE_U_DEV_UART1] ={ 0x10011000, 0x1000 },
+[SIFIVE_U_DEV_GPIO] = { 0x1006, 0x1000 },
+[SIFIVE_U_DEV_OTP] =  { 0x1007, 0x1000 },
+[SIFIVE_U_DEV_GEM] =  { 0x1009, 0x2000 },
+[SIFIVE_U_DEV_GEM_MGMT] = { 0x100a, 0x1000 },
+[SIFIVE_U_DEV_DMC] =  { 0x100b,0x1 },
+[SIFIVE_U_DEV_FLASH0] =   { 0x2000, 0x1000 },
+[SIFIVE_U_DEV_DRAM] = { 0x8000,0x0 },
 };
 
 #define OTP_SERIAL  1
@@ -142,10 +142,10 @@ static void create_fdt(SiFiveUState *s, const struct 
MemmapEntry *memmap,
 g_free(nodename);
 
 nodename = g_strdup_printf("/memory@%lx",
-(long)memmap[SIFIVE_U_DRAM].base);
+(long)memmap[SIFIVE_U_DEV_DRAM].base);
 qemu_fdt_add_subnode(fdt, nodename);
 qemu_fdt_setprop_cells(fdt, nodename, "reg",
-memmap[SIFIVE_U_DRAM].base >> 32, memmap[SIFIVE_U_DRAM].base,
+memmap[SIFIVE_U_DEV_DRAM].base >> 32, memmap[SIFIVE_U_DEV_DRAM].base,
 mem_size >> 32, mem_size);
 qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
 g_free(nodename);
@@ -200,39 +200,39 @@ static void create_fdt(SiFiveUState *s, const struct 
MemmapEntry *memmap,
 g_free(nodename);
 }
 nodename = g_strdup_printf("/soc/clint@%lx",
-(long)memmap[SIFIVE_U_CLINT].base);
+(long)memmap[SIFIVE_U_DEV_CLINT].base);
 qemu_fdt_add_subnode(fdt, nodename);
 qemu_fdt_setprop_string(fdt, nodename, "compatible", "riscv,clint0");
 qemu_fdt_setprop_cells(fdt, nodename, "reg",
-0x0, memmap[SIFIVE_U_CLINT].base,
-0x0, memmap[SIFIVE_U_CLINT].size);
+0x0, memmap[SIFIVE_U_DEV_CLINT].base,
+0x0, memmap[SIFIVE_U_DEV_CLINT].size);
 qemu_fdt_setprop(fdt, nodename, "interrupts-extended",
 cells, ms->smp.cpus * sizeof(uint32_t) * 4);
 g_free(cells);
 g_free(nodename);
 
 nodename = g_strdup_printf("/soc/otp@%lx",
-(long)memmap[SIFIVE_U_OTP].base);
+(long)memmap[SIFIVE_U_DEV_OTP].base);

[PATCH 18/41] i8254: Move PITCommonState/PITCommonClass typedefs to i8254.h

Move typedef closer to the type check macros, to make it easier
to convert the code to OBJECT_DEFINE_TYPE() in the future.

Signed-off-by: Eduardo Habkost 
---
 include/hw/timer/i8254.h  | 2 ++
 include/hw/timer/i8254_internal.h | 8 
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/hw/timer/i8254.h b/include/hw/timer/i8254.h
index e75b4a5a08..206b8f8464 100644
--- a/include/hw/timer/i8254.h
+++ b/include/hw/timer/i8254.h
@@ -39,6 +39,8 @@ typedef struct PITChannelInfo {
 } PITChannelInfo;
 
 #define TYPE_PIT_COMMON "pit-common"
+typedef struct PITCommonState PITCommonState;
+typedef struct PITCommonClass PITCommonClass;
 #define PIT_COMMON(obj) \
  OBJECT_CHECK(PITCommonState, (obj), TYPE_PIT_COMMON)
 #define PIT_COMMON_CLASS(klass) \
diff --git a/include/hw/timer/i8254_internal.h 
b/include/hw/timer/i8254_internal.h
index 3db462aecd..a9a600d941 100644
--- a/include/hw/timer/i8254_internal.h
+++ b/include/hw/timer/i8254_internal.h
@@ -50,14 +50,14 @@ typedef struct PITChannelState {
 uint32_t irq_disabled;
 } PITChannelState;
 
-typedef struct PITCommonState {
+struct PITCommonState {
 ISADevice dev;
 MemoryRegion ioports;
 uint32_t iobase;
 PITChannelState channels[3];
-} PITCommonState;
+};
 
-typedef struct PITCommonClass {
+struct PITCommonClass {
 ISADeviceClass parent_class;
 
 void (*set_channel_gate)(PITCommonState *s, PITChannelState *sc, int val);
@@ -65,7 +65,7 @@ typedef struct PITCommonClass {
  PITChannelInfo *info);
 void (*pre_save)(PITCommonState *s);
 void (*post_load)(PITCommonState *s);
-} PITCommonClass;
+};
 
 int pit_get_out(PITChannelState *s, int64_t current_time);
 int64_t pit_get_next_transition_time(PITChannelState *s, int64_t current_time);
-- 
2.26.2

[PATCH 15/41] tulip: Move TulipState typedef to header

Move typedef closer to the type check macros, to make it easier
to convert the code to OBJECT_DEFINE_TYPE() in the future.

Signed-off-by: Eduardo Habkost 
---
 hw/net/tulip.h | 1 +
 hw/net/tulip.c | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/net/tulip.h b/hw/net/tulip.h
index 5271aad8d5..c3fcd4d4e1 100644
--- a/hw/net/tulip.h
+++ b/hw/net/tulip.h
@@ -5,6 +5,7 @@
 #include "net/net.h"
 
 #define TYPE_TULIP "tulip"
+typedef struct TULIPState TULIPState;
 #define TULIP(obj) OBJECT_CHECK(TULIPState, (obj), TYPE_TULIP)
 
 #define CSR(_x) ((_x) << 3)
diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index 4487fd61cf..ca69f7ea5e 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -18,7 +18,7 @@
 #include "trace.h"
 #include "net/eth.h"
 
-typedef struct TULIPState {
+struct TULIPState {
 PCIDevice dev;
 MemoryRegion io;
 MemoryRegion memory;
@@ -44,7 +44,7 @@ typedef struct TULIPState {
 
 uint32_t rx_status;
 uint8_t filter[16][6];
-} TULIPState;
+};
 
 static const VMStateDescription vmstate_pci_tulip = {
 .name = "tulip",
-- 
2.26.2

[PATCH 13/41] hvf: Add missing include

The sysemu/accel.h header is needed for the ACCEL_CLASS_NAME
macro.  This will be necessary to allow us to use OBJECT_DEFINE*()
for TYPE_HVF_ACCEL.

Signed-off-by: Eduardo Habkost 
---
 include/sysemu/hvf.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
index 6d3ee4fdb7..d3bed80ea8 100644
--- a/include/sysemu/hvf.h
+++ b/include/sysemu/hvf.h
@@ -13,6 +13,8 @@
 #ifndef HVF_H
 #define HVF_H
 
+#include "sysemu/accel.h"
+
 #ifdef CONFIG_HVF
 uint32_t hvf_get_supported_cpuid(uint32_t func, uint32_t idx,
  int reg);
-- 
2.26.2

[PATCH 37/41] [automated] Use DECLARE_CHECKER when possible (--force mode)

Separate run of the script using the --force flag, for the cases
where the typedef wasn't found in the same header.

Generated using:

 $ ./scripts/codeconverter/converter.py --force -i \
   --pattern=TypeCheckMacro $(git grep -l '' -- '*.[ch]')

This is being done as a separate commit because it has more
potential to break the build because typedefs might be really
unavailable.

Signed-off-by: Eduardo Habkost 
---
 hw/ide/ahci_internal.h  |  7 ---
 include/chardev/char.h  |  7 ++-
 include/exec/memory.h   | 14 --
 include/hw/arm/omap.h   |  8 
 include/hw/boards.h |  8 ++--
 include/hw/i2c/i2c.h|  3 ++-
 include/hw/i386/pc.h|  8 ++--
 include/hw/intc/arm_gic.h   |  8 ++--
 include/hw/intc/arm_gicv3.h |  7 ++-
 include/hw/isa/isa.h| 11 ---
 include/hw/nvram/fw_cfg.h   |  9 ++---
 include/hw/pci/pci.h| 13 -
 include/hw/pci/pci_bridge.h |  3 ++-
 include/hw/pci/pci_host.h   |  8 ++--
 include/hw/pci/pcie_host.h  |  4 ++--
 include/hw/pci/pcie_port.h  |  6 --
 include/hw/ppc/spapr.h  | 12 
 include/hw/ppc/xics_spapr.h |  3 ++-
 include/hw/qdev-core.h  | 10 --
 include/hw/s390x/event-facility.h   | 10 ++
 include/hw/sysbus.h |  3 ++-
 include/hw/virtio/virtio-mmio.h |  8 ++--
 include/hw/virtio/virtio.h  |  8 ++--
 include/hw/xen/xen-legacy-backend.h |  4 ++--
 include/net/filter.h|  8 ++--
 include/sysemu/kvm_int.h|  4 ++--
 include/ui/console.h|  8 ++--
 hw/arm/pxa2xx.c |  7 ---
 hw/char/virtio-serial-bus.c |  4 ++--
 hw/core/irq.c   |  3 ++-
 hw/display/vhost-user-gpu.c |  4 ++--
 hw/display/vmware_vga.c |  4 ++--
 hw/dma/i8257.c  |  4 ++--
 hw/hyperv/vmbus.c   |  3 ++-
 hw/ide/ahci-allwinner.c |  4 ++--
 hw/input/pckbd.c|  3 ++-
 hw/intc/apic.c  |  4 ++--
 hw/intc/arm_gic_kvm.c   |  8 ++--
 hw/intc/arm_gicv3_its_kvm.c |  7 ++-
 hw/intc/arm_gicv3_kvm.c |  8 ++--
 hw/intc/etraxfs_pic.c   |  4 ++--
 hw/intc/loongson_liointc.c  |  4 ++--
 hw/intc/xilinx_intc.c   |  3 ++-
 hw/isa/piix3.c  |  4 ++--
 hw/misc/auxbus.c|  3 ++-
 hw/net/rocker/rocker.c  |  4 ++--
 hw/net/xilinx_ethlite.c |  4 ++--
 hw/pci-host/pnv_phb3.c  |  4 ++--
 hw/pci-host/pnv_phb4.c  |  4 ++--
 hw/pci-host/versatile.c |  4 ++--
 hw/pcmcia/pxa2xx.c  |  4 ++--
 hw/scsi/mptsas.c|  4 ++--
 hw/sd/allwinner-sdhost.c|  4 ++--
 hw/sd/bcm2835_sdhost.c  |  4 ++--
 hw/sd/pxa2xx_mmci.c |  6 --
 hw/sd/sdhci.c   |  3 ++-
 hw/ssi/ssi.c|  3 ++-
 hw/timer/xilinx_timer.c |  4 ++--
 hw/vfio/pci.c   |  3 ++-
 59 files changed, 142 insertions(+), 196 deletions(-)

diff --git a/hw/ide/ahci_internal.h b/hw/ide/ahci_internal.h
index 8c1b86021b..9ac085dad2 100644
--- a/hw/ide/ahci_internal.h
+++ b/hw/ide/ahci_internal.h
@@ -333,8 +333,8 @@ struct AHCIPCIState {
 AHCIState ahci;
 };
 
-#define ICH_AHCI(obj) \
-OBJECT_CHECK(AHCIPCIState, (obj), TYPE_ICH9_AHCI)
+DECLARE_INSTANCE_CHECKER(AHCIPCIState, ICH_AHCI,
+ TYPE_ICH9_AHCI)
 
 extern const VMStateDescription vmstate_ahci;
 
@@ -395,6 +395,7 @@ void ahci_uninit(AHCIState *s);
 
 void ahci_reset(AHCIState *s);
 
-#define SYSBUS_AHCI(obj) OBJECT_CHECK(SysbusAHCIState, (obj), TYPE_SYSBUS_AHCI)
+DECLARE_INSTANCE_CHECKER(SysbusAHCIState, SYSBUS_AHCI,
+ TYPE_SYSBUS_AHCI)
 
 #endif /* HW_IDE_AHCI_INTERNAL_H */
diff --git a/include/chardev/char.h b/include/chardev/char.h
index d91d851b33..5874de57ea 100644
--- a/include/chardev/char.h
+++ b/include/chardev/char.h
@@ -227,11 +227,8 @@ int qemu_chr_wait_connected(Chardev *chr, Error **errp);
 
 #define TYPE_CHARDEV "chardev"
 typedef struct ChardevClass ChardevClass;
-#define CHARDEV(obj) OBJECT_CHECK(Chardev, (obj), TYPE_CHARDEV)
-#define CHARDEV_CLASS(klass) \
-OBJECT_CLASS_CHECK(ChardevClass, (klass), TYPE_CHARDEV)
-#define CHARDEV_GET_CLASS(obj) \
-OBJECT_GET_CLASS(ChardevClass, (obj), TYPE_CHARDEV)
+DECLARE_OBJ_CHECKERS(Chardev, ChardevClass,
+ CHARDEV, TYPE_CHARDEV)
 
 #define TYPE_CHARDEV_NULL "chardev-null"
 #define TYPE_CHARDEV_MUX "chardev-mux"
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 6be7072ac5..96e33f700f 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -34,19

[PATCH 11/41] versatile: Fix typo in PCI_VPB_HOST definition

Signed-off-by: Eduardo Habkost 
---
 hw/pci-host/versatile.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 616882a80d..7e4aa467a2 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -161,7 +161,7 @@ static const VMStateDescription pci_vpb_vmstate = {
 
 #define TYPE_VERSATILE_PCI_HOST "versatile_pci_host"
 #define PCI_VPB_HOST(obj) \
-OBJECT_CHECK(PCIDevice, (obj), TYPE_VERSATILE_PCIHOST)
+OBJECT_CHECK(PCIDevice, (obj), TYPE_VERSATILE_PCI_HOST)
 
 typedef enum {
 PCI_IMAP0 = 0x0,
-- 
2.26.2

[PATCH 03/41] megasas: Rename QOM class cast macros

Rename the MEGASAS_DEVICE_CLASS() and MEGASAS_DEVICE_GET_CLASS()
macros to be consistent with the MEGASAS() instance cast macro.

This will allow us to register the type cast macros using
OBJECT_DECLARE_TYPE later.

Signed-off-by: Eduardo Habkost 
---
 hw/scsi/megasas.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 5cfd1bf22e..390c2f2edb 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -134,9 +134,9 @@ typedef struct MegasasBaseClass {
 #define MEGASAS(obj) \
 OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS_BASE)
 
-#define MEGASAS_DEVICE_CLASS(oc) \
+#define MEGASAS_CLASS(oc) \
 OBJECT_CLASS_CHECK(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
-#define MEGASAS_DEVICE_GET_CLASS(oc) \
+#define MEGASAS_GET_CLASS(oc) \
 OBJECT_GET_CLASS(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
 
 #define MEGASAS_INTR_DISABLED_MASK 0x
@@ -733,7 +733,7 @@ static int megasas_ctrl_get_info(MegasasState *s, 
MegasasCmd *cmd)
 {
 PCIDevice *pci_dev = PCI_DEVICE(s);
 PCIDeviceClass *pci_class = PCI_DEVICE_GET_CLASS(pci_dev);
-MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
+MegasasBaseClass *base_class = MEGASAS_GET_CLASS(s);
 struct mfi_ctrl_info info;
 size_t dcmd_size = sizeof(info);
 BusChild *kid;
@@ -1999,7 +1999,7 @@ static uint64_t megasas_mmio_read(void *opaque, hwaddr 
addr,
 {
 MegasasState *s = opaque;
 PCIDevice *pci_dev = PCI_DEVICE(s);
-MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
+MegasasBaseClass *base_class = MEGASAS_GET_CLASS(s);
 uint32_t retval = 0;
 
 switch (addr) {
@@ -2322,7 +2322,7 @@ static const struct SCSIBusInfo megasas_scsi_info = {
 static void megasas_scsi_realize(PCIDevice *dev, Error **errp)
 {
 MegasasState *s = MEGASAS(dev);
-MegasasBaseClass *b = MEGASAS_DEVICE_GET_CLASS(s);
+MegasasBaseClass *b = MEGASAS_GET_CLASS(s);
 uint8_t *pci_conf;
 int i, bar_type;
 Error *err = NULL;
@@ -2506,7 +2506,7 @@ static void megasas_class_init(ObjectClass *oc, void 
*data)
 {
 DeviceClass *dc = DEVICE_CLASS(oc);
 PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
-MegasasBaseClass *e = MEGASAS_DEVICE_CLASS(oc);
+MegasasBaseClass *e = MEGASAS_CLASS(oc);
 const MegasasInfo *info = data;
 
 pc->realize = megasas_scsi_realize;
-- 
2.26.2

[PATCH 00/41] qom: Automated conversion of type checking boilerplate

This is an extension of the series previously submitted by
Daniel[1], including a script that will convert existing type
checker macros automatically.

The series is divided in the following sections:

Constant renaming
-

Patches 1-10 will just rename existing constants that will
conflict with the type checker function names.

Fix and cleanups of existing code
-

Patches 11-25 are changes to existing code
that will either fix existing issues, delete unused and broken
macros, or move typedefs around to make code conversion easier.

Original patches from Daniel


Patches 24-25 are the ones originally submitted by Daniel.

They introduce the macros:
* OBJECT_DECLARE_TYPE
* OBJECT_DECLARE_SIMPLE_TYPE
* OBJECT_DEFINE_TYPE
* OBJECT_DEFINE_TYPE_WITH_INTERFACES
* OBJECT_DEFINE_ABSTRACT_TYPE

Changes to new macros
-

Patches 26-31 extend the macros introduced by Daniel.  It
includes small bug fixes, change the arguments to a few macros,
and introduce a few new macros:

* DECLARE_INSTANCE_CHECKER
* DECLARE_CLASS_CHECKERS
* DECLARE_OBJ_CHECKERS
* TYPE_INFO

Automated code conversion
-

Patch 32 is the code conversion script that will look for common
patterns and change them to use the new macros.

Patches 33-39 are all automatically generated by that script, to
gradually transform existing code into DECLARE_*CHECKER or
OBJECT_DECLARE*_TYPE macros.

Original crypto QOM patches from Daniel
---

Patches 40-41 are the patches originally sent by Daniel to
convert the crypto QOM code to use the new macros, rebased and
updated to pass additional arguments to OBJECT_DECLARE_*.

[1] https://lore.kernel.org/qemu-devel/20200723181410.3145233-1-berrange@redh=
at.com/

Daniel P. Berrang=C3=A9 (4):
  qom: make object_ref/unref use a void * instead of Object *.
  qom: provide convenient macros for declaring and defining types
  crypto: use QOM macros for declaration/definition of secret types
  crypto: use QOM macros for declaration/definition of TLS creds types

Eduardo Habkost (37):
  pl1110: Rename PL1110 enum
  e1000: Rename QOM class cast macros
  megasas: Rename QOM class cast macros
  vmw_pvscsi: Rename QOM class cast macros
  aspeed_timer: Fix ASPEED_TIMER macro definition
  allwinner-h3: Rename memmap enum constants
  aspeed_soc: Rename memmap/irqmap enum constants
  opentitan: Rename memmap enum constants
  sifive_e: Rename memmap enum constants
  sifive_u: Rename memmap enum constants
  versatile: Fix typo in PCI_VPB_HOST definition
  virtio-ccw: Fix definition of VIRTIO_CCW_BUS_GET_CLASS
  hvf: Add missing include
  hcd-dwc2: Rename USB_*CLASS macros for consistency
  tulip: Move TulipState typedef to header
  throttle-groups: Move ThrottleGroup typedef to header
  pci: Move PCIBusClass typedef to pci.h
  i8254: Move PITCommonState/PITCommonClass typedefs to i8254.h
  hvf: Move HVFState typedef to hvf.h
  mcf_fec: Move mcf_fec_state typedef to header
  s390_flic: Move KVMS390FLICState typedef to header
  can_emu: Delete macros for non-existing typedef
  nubus: Delete unused NUBUS_BRIDGE macro
  platform-bus: Delete macros for non-existing typedef
  qom: Fix G_DEFINE_AUTOPTR_CLEANUP_FUNC
  qom: Allow class type name to be specified in OBJECT_DECLARE*
  qom: DECLARE_*_CHECKERS macros
  qom: Make type checker functions accept const pointers
  qom: TYPE_INFO macro
  codeconverter: script for automating QOM code cleanups
  [automated] Delete duplicate QOM typedefs
  [automated] Use TYPE_INFO macro
  [automated] Move QOM typedefs and add missing includes
  [automated] Use DECLARE_*CHECKER* macros
  [automated] Use DECLARE_*CHECKER* when possible (--force mode)
  [automated] Use OBJECT_DECLARE_TYPE where possible
  [automated] Use OBJECT_DECLARE_SIMPLE_TYPE when possible

 .../codeconverter/codeconverter/__init__.py   |   0
 .../codeconverter/codeconverter/patching.py   | 369 +++
 .../codeconverter/codeconverter/qom_macros.py | 614 ++
 .../codeconverter/qom_type_info.py| 314 +
 .../codeconverter/codeconverter/regexps.py|  89 +++
 .../codeconverter/test_patching.py|  98 +++
 .../codeconverter/test_regexps.py | 272 
 scripts/codeconverter/codeconverter/utils.py  |  65 ++
 scripts/codeconverter/converter.py| 113 
 chardev/chardev-internal.h|   8 +-
 hw/9pfs/virtio-9p.h   |  11 +-
 hw/audio/intel-hda.h  |  20 +-
 hw/avr/atmega.h   |   9 +-
 hw/block/nvme.h   |  10 +-
 hw/display/ati_int.h  |   9 +-
 hw/display/qxl.h  |   9 +-
 hw/display/virtio-vga.h   |  17 +-
 hw/i386/amd_iommu.h   |  10 +-
 hw/ide/ahci_internal.h|   8 +-
 hw/misc/tmp105.h

[PATCH 12/41] virtio-ccw: Fix definition of VIRTIO_CCW_BUS_GET_CLASS

The macro was incorrectly defined using OBJECT_CHECK.

Signed-off-by: Eduardo Habkost 
---
 hw/s390x/virtio-ccw.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/s390x/virtio-ccw.h b/hw/s390x/virtio-ccw.h
index c0e3355248..b281896f7d 100644
--- a/hw/s390x/virtio-ccw.h
+++ b/hw/s390x/virtio-ccw.h
@@ -65,9 +65,9 @@ typedef struct VirtioBusClass VirtioCcwBusClass;
 
 #define TYPE_VIRTIO_CCW_BUS "virtio-ccw-bus"
 #define VIRTIO_CCW_BUS(obj) \
- OBJECT_CHECK(VirtioCcwBus, (obj), TYPE_VIRTIO_CCW_BUS)
+ OBJECT_CHECK(VirtioCcwBusState, (obj), TYPE_VIRTIO_CCW_BUS)
 #define VIRTIO_CCW_BUS_GET_CLASS(obj) \
-OBJECT_CHECK(VirtioCcwBusState, (obj), TYPE_VIRTIO_CCW_BUS)
+OBJECT_GET_CLASS(VirtioCcwBusClass, (obj), TYPE_VIRTIO_CCW_BUS)
 #define VIRTIO_CCW_BUS_CLASS(klass) \
 OBJECT_CLASS_CHECK(VirtioCcwBusClass, klass, TYPE_VIRTIO_CCW_BUS)
 
-- 
2.26.2

[PATCH 24/41] platform-bus: Delete macros for non-existing typedef

PlatformBusDeviceClass doesn't exist.  This will break when we
automatically convert the code to use OBJECT_DEFINE_TYPE().
Delete the macros that reference the non-existing typedef.

Signed-off-by: Eduardo Habkost 
---
 include/hw/platform-bus.h | 4 
 1 file changed, 4 deletions(-)

diff --git a/include/hw/platform-bus.h b/include/hw/platform-bus.h
index 19e20c57ce..33745a418e 100644
--- a/include/hw/platform-bus.h
+++ b/include/hw/platform-bus.h
@@ -29,10 +29,6 @@ typedef struct PlatformBusDevice PlatformBusDevice;
 #define TYPE_PLATFORM_BUS_DEVICE "platform-bus-device"
 #define PLATFORM_BUS_DEVICE(obj) \
  OBJECT_CHECK(PlatformBusDevice, (obj), TYPE_PLATFORM_BUS_DEVICE)
-#define PLATFORM_BUS_DEVICE_CLASS(klass) \
- OBJECT_CLASS_CHECK(PlatformBusDeviceClass, (klass), 
TYPE_PLATFORM_BUS_DEVICE)
-#define PLATFORM_BUS_DEVICE_GET_CLASS(obj) \
- OBJECT_GET_CLASS(PlatformBusDeviceClass, (obj), TYPE_PLATFORM_BUS_DEVICE)
 
 struct PlatformBusDevice {
 /*< private >*/
-- 
2.26.2

[PATCH 07/41] aspeed_soc: Rename memmap/irqmap enum constants

Some of the enum constant names conflict with the QOM type check
macros.  This needs to be addressed to allow us to transform the
QOM type check macros into functions generated by
OBJECT_DECLARE_TYPE().

Rename all the constants to ASPEED_DEV_*, to avoid conflicts.

Signed-off-by: Eduardo Habkost 
---
 include/hw/arm/aspeed_soc.h |  92 +++
 hw/arm/aspeed.c |   4 +-
 hw/arm/aspeed_ast2600.c | 208 
 hw/arm/aspeed_soc.c | 228 ++--
 4 files changed, 266 insertions(+), 266 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 914115f3ef..d46f197cbe 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -87,52 +87,52 @@ typedef struct AspeedSoCClass {
 OBJECT_GET_CLASS(AspeedSoCClass, (obj), TYPE_ASPEED_SOC)
 
 enum {
-ASPEED_IOMEM,
-ASPEED_UART1,
-ASPEED_UART2,
-ASPEED_UART3,
-ASPEED_UART4,
-ASPEED_UART5,
-ASPEED_VUART,
-ASPEED_FMC,
-ASPEED_SPI1,
-ASPEED_SPI2,
-ASPEED_EHCI1,
-ASPEED_EHCI2,
-ASPEED_VIC,
-ASPEED_SDMC,
-ASPEED_SCU,
-ASPEED_ADC,
-ASPEED_VIDEO,
-ASPEED_SRAM,
-ASPEED_SDHCI,
-ASPEED_GPIO,
-ASPEED_GPIO_1_8V,
-ASPEED_RTC,
-ASPEED_TIMER1,
-ASPEED_TIMER2,
-ASPEED_TIMER3,
-ASPEED_TIMER4,
-ASPEED_TIMER5,
-ASPEED_TIMER6,
-ASPEED_TIMER7,
-ASPEED_TIMER8,
-ASPEED_WDT,
-ASPEED_PWM,
-ASPEED_LPC,
-ASPEED_IBT,
-ASPEED_I2C,
-ASPEED_ETH1,
-ASPEED_ETH2,
-ASPEED_ETH3,
-ASPEED_ETH4,
-ASPEED_MII1,
-ASPEED_MII2,
-ASPEED_MII3,
-ASPEED_MII4,
-ASPEED_SDRAM,
-ASPEED_XDMA,
-ASPEED_EMMC,
+ASPEED_DEV_IOMEM,
+ASPEED_DEV_UART1,
+ASPEED_DEV_UART2,
+ASPEED_DEV_UART3,
+ASPEED_DEV_UART4,
+ASPEED_DEV_UART5,
+ASPEED_DEV_VUART,
+ASPEED_DEV_FMC,
+ASPEED_DEV_SPI1,
+ASPEED_DEV_SPI2,
+ASPEED_DEV_EHCI1,
+ASPEED_DEV_EHCI2,
+ASPEED_DEV_VIC,
+ASPEED_DEV_SDMC,
+ASPEED_DEV_SCU,
+ASPEED_DEV_ADC,
+ASPEED_DEV_VIDEO,
+ASPEED_DEV_SRAM,
+ASPEED_DEV_SDHCI,
+ASPEED_DEV_GPIO,
+ASPEED_DEV_GPIO_1_8V,
+ASPEED_DEV_RTC,
+ASPEED_DEV_TIMER1,
+ASPEED_DEV_TIMER2,
+ASPEED_DEV_TIMER3,
+ASPEED_DEV_TIMER4,
+ASPEED_DEV_TIMER5,
+ASPEED_DEV_TIMER6,
+ASPEED_DEV_TIMER7,
+ASPEED_DEV_TIMER8,
+ASPEED_DEV_WDT,
+ASPEED_DEV_PWM,
+ASPEED_DEV_LPC,
+ASPEED_DEV_IBT,
+ASPEED_DEV_I2C,
+ASPEED_DEV_ETH1,
+ASPEED_DEV_ETH2,
+ASPEED_DEV_ETH3,
+ASPEED_DEV_ETH4,
+ASPEED_DEV_MII1,
+ASPEED_DEV_MII2,
+ASPEED_DEV_MII3,
+ASPEED_DEV_MII4,
+ASPEED_DEV_SDRAM,
+ASPEED_DEV_XDMA,
+ASPEED_DEV_EMMC,
 };
 
 #endif /* ASPEED_SOC_H */
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index fcb1a7cd87..8109cc6d2d 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -309,7 +309,7 @@ static void aspeed_machine_init(MachineState *machine)
 qdev_realize(DEVICE(>soc), NULL, _abort);
 
 memory_region_add_subregion(get_system_memory(),
-sc->memmap[ASPEED_SDRAM],
+sc->memmap[ASPEED_DEV_SDRAM],
 >ram_container);
 
 max_ram_size = object_property_get_uint(OBJECT(>soc), "max-ram-size",
@@ -360,7 +360,7 @@ static void aspeed_machine_init(MachineState *machine)
 }
 
 aspeed_board_binfo.ram_size = ram_size;
-aspeed_board_binfo.loader_start = sc->memmap[ASPEED_SDRAM];
+aspeed_board_binfo.loader_start = sc->memmap[ASPEED_DEV_SDRAM];
 aspeed_board_binfo.nb_cpus = sc->num_cpus;
 
 if (amc->i2c_init) {
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 3767f7d8d0..9d95e42143 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -24,43 +24,43 @@
 #define ASPEED_SOC_IOMEM_SIZE   0x0020
 
 static const hwaddr aspeed_soc_ast2600_memmap[] = {
-[ASPEED_SRAM]  = 0x1000,
+[ASPEED_DEV_SRAM]  = 0x1000,
 /* 0x1600 0x17FF : AHB BUS do LPC Bus bridge */
-[ASPEED_IOMEM] = 0x1E60,
-[ASPEED_PWM]   = 0x1E61,
-[ASPEED_FMC]   = 0x1E62,
-[ASPEED_SPI1]  = 0x1E63,
-[ASPEED_SPI2]  = 0x1E641000,
-[ASPEED_EHCI1] = 0x1E6A1000,
-[ASPEED_EHCI2] = 0x1E6A3000,
-[ASPEED_MII1]  = 0x1E65,
-[ASPEED_MII2]  = 0x1E650008,
-[ASPEED_MII3]  = 0x1E650010,
-[ASPEED_MII4]  = 0x1E650018,
-[ASPEED_ETH1]  = 0x1E66,
-[ASPEED_ETH3]  = 0x1E67,
-[ASPEED_ETH2]  = 0x1E68,
-[ASPEED_ETH4]  = 0x1E69,
-[ASPEED_VIC]   = 0x1E6C,
-[ASPEED_SDMC]  = 0x1E6E,
-[ASPEED_SCU]   = 0x1E6E2000,
-[ASPEED_XDMA]  = 0x1E6E7000,
-[ASPEED_ADC]   = 0x1E6E9000,
-[ASPEED_VIDEO] = 0x1E70,
-[ASPEED_SDHCI] = 0x1E74,
-[ASPEED_EMMC]  = 0x1E75,

[PATCH 16/41] throttle-groups: Move ThrottleGroup typedef to header

Move typedef closer to the type check macros, to make it easier
to convert the code to OBJECT_DEFINE_TYPE() in the future.

Signed-off-by: Eduardo Habkost 
---
 include/block/throttle-groups.h | 1 +
 block/throttle-groups.c | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/block/throttle-groups.h b/include/block/throttle-groups.h
index 712a8e64b4..5e77db700f 100644
--- a/include/block/throttle-groups.h
+++ b/include/block/throttle-groups.h
@@ -59,6 +59,7 @@ typedef struct ThrottleGroupMember {
 } ThrottleGroupMember;
 
 #define TYPE_THROTTLE_GROUP "throttle-group"
+typedef struct ThrottleGroup ThrottleGroup;
 #define THROTTLE_GROUP(obj) OBJECT_CHECK(ThrottleGroup, (obj), 
TYPE_THROTTLE_GROUP)
 
 const char *throttle_group_get_name(ThrottleGroupMember *tgm);
diff --git a/block/throttle-groups.c b/block/throttle-groups.c
index 98fea7fd47..4e28365d8d 100644
--- a/block/throttle-groups.c
+++ b/block/throttle-groups.c
@@ -63,7 +63,7 @@ static void timer_cb(ThrottleGroupMember *tgm, bool is_write);
  * access some other ThrottleGroupMember's timers only after verifying that
  * that ThrottleGroupMember has throttled requests in the queue.
  */
-typedef struct ThrottleGroup {
+struct ThrottleGroup {
 Object parent_obj;
 
 /* refuse individual property change if initialization is complete */
@@ -79,7 +79,7 @@ typedef struct ThrottleGroup {
 
 /* This field is protected by the global QEMU mutex */
 QTAILQ_ENTRY(ThrottleGroup) list;
-} ThrottleGroup;
+};
 
 /* This is protected by the global QEMU mutex */
 static QTAILQ_HEAD(, ThrottleGroup) throttle_groups =
-- 
2.26.2

[PATCH 04/41] vmw_pvscsi: Rename QOM class cast macros

Rename the PVSCSI_DEVICE_CLASS() and PVSCSI_DEVICE_GET_CLASS()
macros to be consistent with the PVSCSI() instance cast macro.

This will allow us to register the type cast macros using
OBJECT_DECLARE_TYPE later.

Signed-off-by: Eduardo Habkost 
---
 hw/scsi/vmw_pvscsi.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index df07ab6bfb..c071e0c7aa 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -64,9 +64,9 @@ typedef struct PVSCSIClass {
 #define TYPE_PVSCSI "pvscsi"
 #define PVSCSI(obj) OBJECT_CHECK(PVSCSIState, (obj), TYPE_PVSCSI)
 
-#define PVSCSI_DEVICE_CLASS(klass) \
+#define PVSCSI_CLASS(klass) \
 OBJECT_CLASS_CHECK(PVSCSIClass, (klass), TYPE_PVSCSI)
-#define PVSCSI_DEVICE_GET_CLASS(obj) \
+#define PVSCSI_GET_CLASS(obj) \
 OBJECT_GET_CLASS(PVSCSIClass, (obj), TYPE_PVSCSI)
 
 /* Compatibility flags for migration */
@@ -1265,7 +1265,7 @@ static Property pvscsi_properties[] = {
 
 static void pvscsi_realize(DeviceState *qdev, Error **errp)
 {
-PVSCSIClass *pvs_c = PVSCSI_DEVICE_GET_CLASS(qdev);
+PVSCSIClass *pvs_c = PVSCSI_GET_CLASS(qdev);
 PCIDevice *pci_dev = PCI_DEVICE(qdev);
 PVSCSIState *s = PVSCSI(qdev);
 
@@ -1280,7 +1280,7 @@ static void pvscsi_class_init(ObjectClass *klass, void 
*data)
 {
 DeviceClass *dc = DEVICE_CLASS(klass);
 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
-PVSCSIClass *pvs_k = PVSCSI_DEVICE_CLASS(klass);
+PVSCSIClass *pvs_k = PVSCSI_CLASS(klass);
 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
 
 k->realize = pvscsi_realizefn;
-- 
2.26.2

[PATCH 08/41] opentitan: Rename memmap enum constants

Some of the enum constant names conflict with the QOM type check
macros.  This needs to be addressed to allow us to transform the
QOM type check macros into functions generated by
OBJECT_DECLARE_TYPE().

Rename all the constants to IBEX_DEV_*, to avoid conflicts.

Signed-off-by: Eduardo Habkost 
---
 include/hw/riscv/opentitan.h | 38 
 hw/riscv/opentitan.c | 84 ++--
 2 files changed, 61 insertions(+), 61 deletions(-)

diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
index 8f29b9cbbf..835a80f896 100644
--- a/include/hw/riscv/opentitan.h
+++ b/include/hw/riscv/opentitan.h
@@ -49,25 +49,25 @@ typedef struct OpenTitanState {
 } OpenTitanState;
 
 enum {
-IBEX_ROM,
-IBEX_RAM,
-IBEX_FLASH,
-IBEX_UART,
-IBEX_GPIO,
-IBEX_SPI,
-IBEX_FLASH_CTRL,
-IBEX_RV_TIMER,
-IBEX_AES,
-IBEX_HMAC,
-IBEX_PLIC,
-IBEX_PWRMGR,
-IBEX_RSTMGR,
-IBEX_CLKMGR,
-IBEX_PINMUX,
-IBEX_ALERT_HANDLER,
-IBEX_NMI_GEN,
-IBEX_USBDEV,
-IBEX_PADCTRL,
+IBEX_DEV_ROM,
+IBEX_DEV_RAM,
+IBEX_DEV_FLASH,
+IBEX_DEV_UART,
+IBEX_DEV_GPIO,
+IBEX_DEV_SPI,
+IBEX_DEV_FLASH_CTRL,
+IBEX_DEV_RV_TIMER,
+IBEX_DEV_AES,
+IBEX_DEV_HMAC,
+IBEX_DEV_PLIC,
+IBEX_DEV_PWRMGR,
+IBEX_DEV_RSTMGR,
+IBEX_DEV_CLKMGR,
+IBEX_DEV_PINMUX,
+IBEX_DEV_ALERT_HANDLER,
+IBEX_DEV_NMI_GEN,
+IBEX_DEV_USBDEV,
+IBEX_DEV_PADCTRL,
 };
 
 enum {
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index a8f0039e51..23ba3b4bfc 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -32,25 +32,25 @@ static const struct MemmapEntry {
 hwaddr base;
 hwaddr size;
 } ibex_memmap[] = {
-[IBEX_ROM] ={  0x8000, 16 * KiB },
-[IBEX_RAM] ={  0x1000,  0x1 },
-[IBEX_FLASH] =  {  0x2000,  0x8 },
-[IBEX_UART] =   {  0x4000,  0x1 },
-[IBEX_GPIO] =   {  0x4001,  0x1 },
-[IBEX_SPI] ={  0x4002,  0x1 },
-[IBEX_FLASH_CTRL] = {  0x4003,  0x1 },
-[IBEX_PINMUX] = {  0x4007,  0x1 },
-[IBEX_RV_TIMER] =   {  0x4008,  0x1 },
-[IBEX_PLIC] =   {  0x4009,  0x1 },
-[IBEX_PWRMGR] = {  0x400A,  0x1 },
-[IBEX_RSTMGR] = {  0x400B,  0x1 },
-[IBEX_CLKMGR] = {  0x400C,  0x1 },
-[IBEX_AES] ={  0x4011,  0x1 },
-[IBEX_HMAC] =   {  0x4012,  0x1 },
-[IBEX_ALERT_HANDLER] =  {  0x4013,  0x1 },
-[IBEX_NMI_GEN] ={  0x4014,  0x1 },
-[IBEX_USBDEV] = {  0x4015,  0x1 },
-[IBEX_PADCTRL] ={  0x4016,  0x1 }
+[IBEX_DEV_ROM] ={  0x8000, 16 * KiB },
+[IBEX_DEV_RAM] ={  0x1000,  0x1 },
+[IBEX_DEV_FLASH] =  {  0x2000,  0x8 },
+[IBEX_DEV_UART] =   {  0x4000,  0x1 },
+[IBEX_DEV_GPIO] =   {  0x4001,  0x1 },
+[IBEX_DEV_SPI] ={  0x4002,  0x1 },
+[IBEX_DEV_FLASH_CTRL] = {  0x4003,  0x1 },
+[IBEX_DEV_PINMUX] = {  0x4007,  0x1 },
+[IBEX_DEV_RV_TIMER] =   {  0x4008,  0x1 },
+[IBEX_DEV_PLIC] =   {  0x4009,  0x1 },
+[IBEX_DEV_PWRMGR] = {  0x400A,  0x1 },
+[IBEX_DEV_RSTMGR] = {  0x400B,  0x1 },
+[IBEX_DEV_CLKMGR] = {  0x400C,  0x1 },
+[IBEX_DEV_AES] ={  0x4011,  0x1 },
+[IBEX_DEV_HMAC] =   {  0x4012,  0x1 },
+[IBEX_DEV_ALERT_HANDLER] =  {  0x4013,  0x1 },
+[IBEX_DEV_NMI_GEN] ={  0x4014,  0x1 },
+[IBEX_DEV_USBDEV] = {  0x4015,  0x1 },
+[IBEX_DEV_PADCTRL] ={  0x4016,  0x1 }
 };
 
 static void opentitan_board_init(MachineState *machine)
@@ -66,12 +66,12 @@ static void opentitan_board_init(MachineState *machine)
 qdev_realize(DEVICE(>soc), NULL, _abort);
 
 memory_region_init_ram(main_mem, NULL, "riscv.lowrisc.ibex.ram",
-memmap[IBEX_RAM].size, _fatal);
+memmap[IBEX_DEV_RAM].size, _fatal);
 memory_region_add_subregion(sys_mem,
-memmap[IBEX_RAM].base, main_mem);
+memmap[IBEX_DEV_RAM].base, main_mem);
 
 if (machine->firmware) {
-riscv_load_firmware(machine->firmware, memmap[IBEX_RAM].base, NULL);
+riscv_load_firmware(machine->firmware, memmap[IBEX_DEV_RAM].base, 
NULL);
 }
 
 if (machine->kernel_filename) {
@@ -115,28 +115,28 @@ static void lowrisc_ibex_soc_realize(DeviceState 
*dev_soc, Error **errp)
 
 /* Boot ROM */
 memory_region_init_rom(>rom, OBJECT(dev_soc), "riscv.lowrisc.ibex.rom",
-   memmap[IBEX_ROM].size, _fatal);
+   memmap[IBEX_DEV_ROM].size, _fatal);

[PATCH 19/41] hvf: Move HVFState typedef to hvf.h

Move typedef closer to the type check macros, to make it easier
to convert the code to OBJECT_DEFINE_TYPE() in the future.

Signed-off-by: Eduardo Habkost 
---
 include/sysemu/hvf.h   | 1 +
 target/i386/hvf/hvf-i386.h | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
index d3bed80ea8..760d6c79a2 100644
--- a/include/sysemu/hvf.h
+++ b/include/sysemu/hvf.h
@@ -35,6 +35,7 @@ void hvf_vcpu_destroy(CPUState *);
 
 #define TYPE_HVF_ACCEL ACCEL_CLASS_NAME("hvf")
 
+typedef struct HVFState HVFState;
 #define HVF_STATE(obj) \
 OBJECT_CHECK(HVFState, (obj), TYPE_HVF_ACCEL)
 
diff --git a/target/i386/hvf/hvf-i386.h b/target/i386/hvf/hvf-i386.h
index ef20c73eca..e0edffd077 100644
--- a/target/i386/hvf/hvf-i386.h
+++ b/target/i386/hvf/hvf-i386.h
@@ -57,13 +57,13 @@ typedef struct hvf_vcpu_caps {
 uint64_t vmx_cap_preemption_timer;
 } hvf_vcpu_caps;
 
-typedef struct HVFState {
+struct HVFState {
 AccelState parent;
 hvf_slot slots[32];
 int num_slots;
 
 hvf_vcpu_caps *hvf_caps;
-} HVFState;
+};
 extern HVFState *hvf_state;
 
 void hvf_set_phys_mem(MemoryRegionSection *, bool);
-- 
2.26.2

[PATCH 14/41] hcd-dwc2: Rename USB_*CLASS macros for consistency

Rename the DWC2_CLASS to DWC2_USB_CLASS and DWC2_GET_CLASS to
DWC2_USB_GET_CLASS, for consistency with the DWC2_USB macro.

Signed-off-by: Eduardo Habkost 
---
 hw/usb/hcd-dwc2.h | 4 ++--
 hw/usb/hcd-dwc2.c | 8 
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/usb/hcd-dwc2.h b/hw/usb/hcd-dwc2.h
index 4ba809a07b..54111d835e 100644
--- a/hw/usb/hcd-dwc2.h
+++ b/hw/usb/hcd-dwc2.h
@@ -182,9 +182,9 @@ struct DWC2Class {
 #define TYPE_DWC2_USB   "dwc2-usb"
 #define DWC2_USB(obj) \
 OBJECT_CHECK(DWC2State, (obj), TYPE_DWC2_USB)
-#define DWC2_CLASS(klass) \
+#define DWC2_USB_CLASS(klass) \
 OBJECT_CLASS_CHECK(DWC2Class, (klass), TYPE_DWC2_USB)
-#define DWC2_GET_CLASS(obj) \
+#define DWC2_USB_GET_CLASS(obj) \
 OBJECT_GET_CLASS(DWC2Class, (obj), TYPE_DWC2_USB)
 
 #endif
diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c
index 56f91f6bee..97688d21bf 100644
--- a/hw/usb/hcd-dwc2.c
+++ b/hw/usb/hcd-dwc2.c
@@ -1155,7 +1155,7 @@ static void dwc2_work_timer(void *opaque)
 
 static void dwc2_reset_enter(Object *obj, ResetType type)
 {
-DWC2Class *c = DWC2_GET_CLASS(obj);
+DWC2Class *c = DWC2_USB_GET_CLASS(obj);
 DWC2State *s = DWC2_USB(obj);
 int i;
 
@@ -1239,7 +1239,7 @@ static void dwc2_reset_enter(Object *obj, ResetType type)
 
 static void dwc2_reset_hold(Object *obj)
 {
-DWC2Class *c = DWC2_GET_CLASS(obj);
+DWC2Class *c = DWC2_USB_GET_CLASS(obj);
 DWC2State *s = DWC2_USB(obj);
 
 trace_usb_dwc2_reset_hold();
@@ -1253,7 +1253,7 @@ static void dwc2_reset_hold(Object *obj)
 
 static void dwc2_reset_exit(Object *obj)
 {
-DWC2Class *c = DWC2_GET_CLASS(obj);
+DWC2Class *c = DWC2_USB_GET_CLASS(obj);
 DWC2State *s = DWC2_USB(obj);
 
 trace_usb_dwc2_reset_exit();
@@ -1382,7 +1382,7 @@ static Property dwc2_usb_properties[] = {
 static void dwc2_class_init(ObjectClass *klass, void *data)
 {
 DeviceClass *dc = DEVICE_CLASS(klass);
-DWC2Class *c = DWC2_CLASS(klass);
+DWC2Class *c = DWC2_USB_CLASS(klass);
 ResettableClass *rc = RESETTABLE_CLASS(klass);
 
 dc->realize = dwc2_realize;
-- 
2.26.2

[PATCH 09/41] sifive_e: Rename memmap enum constants

Some of the enum constant names conflict with the QOM type check
macros.  This needs to be addressed to allow us to transform the
QOM type check macros into functions generated by
OBJECT_DECLARE_TYPE().

Rename all the constants to SIFIVE_E_DEV_*, to avoid conflicts.

Signed-off-by: Eduardo Habkost 
---
 include/hw/riscv/sifive_e.h | 38 -
 hw/riscv/sifive_e.c | 82 ++---
 2 files changed, 60 insertions(+), 60 deletions(-)

diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index 637414130b..7c2eb70189 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -53,25 +53,25 @@ typedef struct SiFiveEState {
 OBJECT_CHECK(SiFiveEState, (obj), TYPE_RISCV_E_MACHINE)
 
 enum {
-SIFIVE_E_DEBUG,
-SIFIVE_E_MROM,
-SIFIVE_E_OTP,
-SIFIVE_E_CLINT,
-SIFIVE_E_PLIC,
-SIFIVE_E_AON,
-SIFIVE_E_PRCI,
-SIFIVE_E_OTP_CTRL,
-SIFIVE_E_GPIO0,
-SIFIVE_E_UART0,
-SIFIVE_E_QSPI0,
-SIFIVE_E_PWM0,
-SIFIVE_E_UART1,
-SIFIVE_E_QSPI1,
-SIFIVE_E_PWM1,
-SIFIVE_E_QSPI2,
-SIFIVE_E_PWM2,
-SIFIVE_E_XIP,
-SIFIVE_E_DTIM
+SIFIVE_E_DEV_DEBUG,
+SIFIVE_E_DEV_MROM,
+SIFIVE_E_DEV_OTP,
+SIFIVE_E_DEV_CLINT,
+SIFIVE_E_DEV_PLIC,
+SIFIVE_E_DEV_AON,
+SIFIVE_E_DEV_PRCI,
+SIFIVE_E_DEV_OTP_CTRL,
+SIFIVE_E_DEV_GPIO0,
+SIFIVE_E_DEV_UART0,
+SIFIVE_E_DEV_QSPI0,
+SIFIVE_E_DEV_PWM0,
+SIFIVE_E_DEV_UART1,
+SIFIVE_E_DEV_QSPI1,
+SIFIVE_E_DEV_PWM1,
+SIFIVE_E_DEV_QSPI2,
+SIFIVE_E_DEV_PWM2,
+SIFIVE_E_DEV_XIP,
+SIFIVE_E_DEV_DTIM
 };
 
 enum {
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index c8b060486a..88b4524117 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -54,25 +54,25 @@ static const struct MemmapEntry {
 hwaddr base;
 hwaddr size;
 } sifive_e_memmap[] = {
-[SIFIVE_E_DEBUG] ={0x0, 0x1000 },
-[SIFIVE_E_MROM] = { 0x1000, 0x2000 },
-[SIFIVE_E_OTP] =  {0x2, 0x2000 },
-[SIFIVE_E_CLINT] ={  0x200,0x1 },
-[SIFIVE_E_PLIC] = {  0xc00,  0x400 },
-[SIFIVE_E_AON] =  { 0x1000, 0x8000 },
-[SIFIVE_E_PRCI] = { 0x10008000, 0x8000 },
-[SIFIVE_E_OTP_CTRL] = { 0x1001, 0x1000 },
-[SIFIVE_E_GPIO0] ={ 0x10012000, 0x1000 },
-[SIFIVE_E_UART0] ={ 0x10013000, 0x1000 },
-[SIFIVE_E_QSPI0] ={ 0x10014000, 0x1000 },
-[SIFIVE_E_PWM0] = { 0x10015000, 0x1000 },
-[SIFIVE_E_UART1] ={ 0x10023000, 0x1000 },
-[SIFIVE_E_QSPI1] ={ 0x10024000, 0x1000 },
-[SIFIVE_E_PWM1] = { 0x10025000, 0x1000 },
-[SIFIVE_E_QSPI2] ={ 0x10034000, 0x1000 },
-[SIFIVE_E_PWM2] = { 0x10035000, 0x1000 },
-[SIFIVE_E_XIP] =  { 0x2000, 0x2000 },
-[SIFIVE_E_DTIM] = { 0x8000, 0x4000 }
+[SIFIVE_E_DEV_DEBUG] ={0x0, 0x1000 },
+[SIFIVE_E_DEV_MROM] = { 0x1000, 0x2000 },
+[SIFIVE_E_DEV_OTP] =  {0x2, 0x2000 },
+[SIFIVE_E_DEV_CLINT] ={  0x200,0x1 },
+[SIFIVE_E_DEV_PLIC] = {  0xc00,  0x400 },
+[SIFIVE_E_DEV_AON] =  { 0x1000, 0x8000 },
+[SIFIVE_E_DEV_PRCI] = { 0x10008000, 0x8000 },
+[SIFIVE_E_DEV_OTP_CTRL] = { 0x1001, 0x1000 },
+[SIFIVE_E_DEV_GPIO0] ={ 0x10012000, 0x1000 },
+[SIFIVE_E_DEV_UART0] ={ 0x10013000, 0x1000 },
+[SIFIVE_E_DEV_QSPI0] ={ 0x10014000, 0x1000 },
+[SIFIVE_E_DEV_PWM0] = { 0x10015000, 0x1000 },
+[SIFIVE_E_DEV_UART1] ={ 0x10023000, 0x1000 },
+[SIFIVE_E_DEV_QSPI1] ={ 0x10024000, 0x1000 },
+[SIFIVE_E_DEV_PWM1] = { 0x10025000, 0x1000 },
+[SIFIVE_E_DEV_QSPI2] ={ 0x10034000, 0x1000 },
+[SIFIVE_E_DEV_PWM2] = { 0x10035000, 0x1000 },
+[SIFIVE_E_DEV_XIP] =  { 0x2000, 0x2000 },
+[SIFIVE_E_DEV_DTIM] = { 0x8000, 0x4000 }
 };
 
 static void sifive_e_machine_init(MachineState *machine)
@@ -90,9 +90,9 @@ static void sifive_e_machine_init(MachineState *machine)
 
 /* Data Tightly Integrated Memory */
 memory_region_init_ram(main_mem, NULL, "riscv.sifive.e.ram",
-memmap[SIFIVE_E_DTIM].size, _fatal);
+memmap[SIFIVE_E_DEV_DTIM].size, _fatal);
 memory_region_add_subregion(sys_mem,
-memmap[SIFIVE_E_DTIM].base, main_mem);
+memmap[SIFIVE_E_DEV_DTIM].base, main_mem);
 
 /* Mask ROM reset vector */
 uint32_t reset_vec[4];
@@ -111,7 +111,7 @@ static void sifive_e_machine_init(MachineState *machine)
 reset_vec[i] = cpu_to_le32(reset_vec[i]);
 }
 rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
-  memmap[SIFIVE_E_MROM].base, _space_memory);
+  memmap[SIFIVE_E_DEV_MROM].base, 
_space_memory);
 
 if

[PATCH 02/41] e1000: Rename QOM class cast macros

Rename the E1000_DEVICE_CLASS() and E1000_DEVICE_GET_CLASS()
macros to be consistent with the E1000() instance cast macro.

This will allow us to register the type cast macros using
OBJECT_DECLARE_TYPE later.

Signed-off-by: Eduardo Habkost 
---
 hw/net/e1000.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index a18f80e369..c4d896a9e6 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -151,9 +151,9 @@ typedef struct E1000BaseClass {
 #define E1000(obj) \
 OBJECT_CHECK(E1000State, (obj), TYPE_E1000_BASE)
 
-#define E1000_DEVICE_CLASS(klass) \
+#define E1000_CLASS(klass) \
  OBJECT_CLASS_CHECK(E1000BaseClass, (klass), TYPE_E1000_BASE)
-#define E1000_DEVICE_GET_CLASS(obj) \
+#define E1000_GET_CLASS(obj) \
 OBJECT_GET_CLASS(E1000BaseClass, (obj), TYPE_E1000_BASE)
 
 static void
@@ -365,7 +365,7 @@ e1000_autoneg_timer(void *opaque)
 static void e1000_reset(void *opaque)
 {
 E1000State *d = opaque;
-E1000BaseClass *edc = E1000_DEVICE_GET_CLASS(d);
+E1000BaseClass *edc = E1000_GET_CLASS(d);
 uint8_t *macaddr = d->conf.macaddr.a;
 
 timer_del(d->autoneg_timer);
@@ -1751,7 +1751,7 @@ static void e1000_class_init(ObjectClass *klass, void 
*data)
 {
 DeviceClass *dc = DEVICE_CLASS(klass);
 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
-E1000BaseClass *e = E1000_DEVICE_CLASS(klass);
+E1000BaseClass *e = E1000_CLASS(klass);
 const E1000Info *info = data;
 
 k->realize = pci_e1000_realize;
-- 
2.26.2

[PATCH 06/41] allwinner-h3: Rename memmap enum constants

Some of the enum constant names conflict with the QOM type check
macros.  This needs to be addressed to allow us to transform the
QOM type check macros into functions generated by
OBJECT_DECLARE_TYPE().

Rename all the constants to AW_H3_DEV_*, to avoid conflicts.

Signed-off-by: Eduardo Habkost 
---
 include/hw/arm/allwinner-h3.h |  62 -
 hw/arm/allwinner-h3.c | 124 +-
 hw/arm/orangepi.c |   6 +-
 3 files changed, 96 insertions(+), 96 deletions(-)

diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index 82e4e59216..626139dcb3 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -61,37 +61,37 @@
  * @see AwH3State
  */
 enum {
-AW_H3_SRAM_A1,
-AW_H3_SRAM_A2,
-AW_H3_SRAM_C,
-AW_H3_SYSCTRL,
-AW_H3_MMC0,
-AW_H3_SID,
-AW_H3_EHCI0,
-AW_H3_OHCI0,
-AW_H3_EHCI1,
-AW_H3_OHCI1,
-AW_H3_EHCI2,
-AW_H3_OHCI2,
-AW_H3_EHCI3,
-AW_H3_OHCI3,
-AW_H3_CCU,
-AW_H3_PIT,
-AW_H3_UART0,
-AW_H3_UART1,
-AW_H3_UART2,
-AW_H3_UART3,
-AW_H3_EMAC,
-AW_H3_DRAMCOM,
-AW_H3_DRAMCTL,
-AW_H3_DRAMPHY,
-AW_H3_GIC_DIST,
-AW_H3_GIC_CPU,
-AW_H3_GIC_HYP,
-AW_H3_GIC_VCPU,
-AW_H3_RTC,
-AW_H3_CPUCFG,
-AW_H3_SDRAM
+AW_H3_DEV_SRAM_A1,
+AW_H3_DEV_SRAM_A2,
+AW_H3_DEV_SRAM_C,
+AW_H3_DEV_SYSCTRL,
+AW_H3_DEV_MMC0,
+AW_H3_DEV_SID,
+AW_H3_DEV_EHCI0,
+AW_H3_DEV_OHCI0,
+AW_H3_DEV_EHCI1,
+AW_H3_DEV_OHCI1,
+AW_H3_DEV_EHCI2,
+AW_H3_DEV_OHCI2,
+AW_H3_DEV_EHCI3,
+AW_H3_DEV_OHCI3,
+AW_H3_DEV_CCU,
+AW_H3_DEV_PIT,
+AW_H3_DEV_UART0,
+AW_H3_DEV_UART1,
+AW_H3_DEV_UART2,
+AW_H3_DEV_UART3,
+AW_H3_DEV_EMAC,
+AW_H3_DEV_DRAMCOM,
+AW_H3_DEV_DRAMCTL,
+AW_H3_DEV_DRAMPHY,
+AW_H3_DEV_GIC_DIST,
+AW_H3_DEV_GIC_CPU,
+AW_H3_DEV_GIC_HYP,
+AW_H3_DEV_GIC_VCPU,
+AW_H3_DEV_RTC,
+AW_H3_DEV_CPUCFG,
+AW_H3_DEV_SDRAM
 };
 
 /** Total number of CPU cores in the H3 SoC */
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index ff92ded82c..341abe6718 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -35,37 +35,37 @@
 
 /* Memory map */
 const hwaddr allwinner_h3_memmap[] = {
-[AW_H3_SRAM_A1]= 0x,
-[AW_H3_SRAM_A2]= 0x00044000,
-[AW_H3_SRAM_C] = 0x0001,
-[AW_H3_SYSCTRL]= 0x01c0,
-[AW_H3_MMC0]   = 0x01c0f000,
-[AW_H3_SID]= 0x01c14000,
-[AW_H3_EHCI0]  = 0x01c1a000,
-[AW_H3_OHCI0]  = 0x01c1a400,
-[AW_H3_EHCI1]  = 0x01c1b000,
-[AW_H3_OHCI1]  = 0x01c1b400,
-[AW_H3_EHCI2]  = 0x01c1c000,
-[AW_H3_OHCI2]  = 0x01c1c400,
-[AW_H3_EHCI3]  = 0x01c1d000,
-[AW_H3_OHCI3]  = 0x01c1d400,
-[AW_H3_CCU]= 0x01c2,
-[AW_H3_PIT]= 0x01c20c00,
-[AW_H3_UART0]  = 0x01c28000,
-[AW_H3_UART1]  = 0x01c28400,
-[AW_H3_UART2]  = 0x01c28800,
-[AW_H3_UART3]  = 0x01c28c00,
-[AW_H3_EMAC]   = 0x01c3,
-[AW_H3_DRAMCOM]= 0x01c62000,
-[AW_H3_DRAMCTL]= 0x01c63000,
-[AW_H3_DRAMPHY]= 0x01c65000,
-[AW_H3_GIC_DIST]   = 0x01c81000,
-[AW_H3_GIC_CPU]= 0x01c82000,
-[AW_H3_GIC_HYP]= 0x01c84000,
-[AW_H3_GIC_VCPU]   = 0x01c86000,
-[AW_H3_RTC]= 0x01f0,
-[AW_H3_CPUCFG] = 0x01f01c00,
-[AW_H3_SDRAM]  = 0x4000
+[AW_H3_DEV_SRAM_A1]= 0x,
+[AW_H3_DEV_SRAM_A2]= 0x00044000,
+[AW_H3_DEV_SRAM_C] = 0x0001,
+[AW_H3_DEV_SYSCTRL]= 0x01c0,
+[AW_H3_DEV_MMC0]   = 0x01c0f000,
+[AW_H3_DEV_SID]= 0x01c14000,
+[AW_H3_DEV_EHCI0]  = 0x01c1a000,
+[AW_H3_DEV_OHCI0]  = 0x01c1a400,
+[AW_H3_DEV_EHCI1]  = 0x01c1b000,
+[AW_H3_DEV_OHCI1]  = 0x01c1b400,
+[AW_H3_DEV_EHCI2]  = 0x01c1c000,
+[AW_H3_DEV_OHCI2]  = 0x01c1c400,
+[AW_H3_DEV_EHCI3]  = 0x01c1d000,
+[AW_H3_DEV_OHCI3]  = 0x01c1d400,
+[AW_H3_DEV_CCU]= 0x01c2,
+[AW_H3_DEV_PIT]= 0x01c20c00,
+[AW_H3_DEV_UART0]  = 0x01c28000,
+[AW_H3_DEV_UART1]  = 0x01c28400,
+[AW_H3_DEV_UART2]  = 0x01c28800,
+[AW_H3_DEV_UART3]  = 0x01c28c00,
+[AW_H3_DEV_EMAC]   = 0x01c3,
+[AW_H3_DEV_DRAMCOM]= 0x01c62000,
+[AW_H3_DEV_DRAMCTL]= 0x01c63000,
+[AW_H3_DEV_DRAMPHY]= 0x01c65000,
+[AW_H3_DEV_GIC_DIST]   = 0x01c81000,
+[AW_H3_DEV_GIC_CPU]= 0x01c82000,
+[AW_H3_DEV_GIC_HYP]= 0x01c84000,
+[AW_H3_DEV_GIC_VCPU]   = 0x01c86000,
+[AW_H3_DEV_RTC]= 0x01f0,
+[AW_H3_DEV_CPUCFG] = 0x01f01c00,
+[AW_H3_DEV_SDRAM]  = 0x4000
 };
 
 /* List of unimplemented devices */
@@ -183,7 +183,7 @@ void allwinner_h3_bootrom_setup(AwH3State *s, BlockBackend 
*blk)
 }
 
 rom_add_blob("allwinner-h3.bootrom", buffer, rom_size,
-

[PATCH 01/41] pl1110: Rename PL1110 enum

The PL1110 enum value name will conflict with the PL1110 type
cast checker, when we replace the existing macro with an inline
function.  Rename it to PL1110_STOCK.

Signed-off-by: Eduardo Habkost 
---
 hw/display/pl110.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index c2991a28d2..4664fde3f2 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -42,7 +42,7 @@ enum pl110_bppmode
 /* The Versatile/PB uses a slightly modified PL110 controller.  */
 enum pl110_version
 {
-PL110,
+PL110_STOCK,
 PL110_VERSATILE,
 PL111
 };
@@ -372,12 +372,12 @@ static uint64_t pl110_read(void *opaque, hwaddr offset,
 case 5: /* LCDLPBASE */
 return s->lpbase;
 case 6: /* LCDIMSC */
-if (s->version != PL110) {
+if (s->version != PL110_STOCK) {
 return s->cr;
 }
 return s->int_mask;
 case 7: /* LCDControl */
-if (s->version != PL110) {
+if (s->version != PL110_STOCK) {
 return s->int_mask;
 }
 return s->cr;
@@ -437,7 +437,7 @@ static void pl110_write(void *opaque, hwaddr offset,
 s->lpbase = val;
 break;
 case 6: /* LCDIMSC */
-if (s->version != PL110) {
+if (s->version != PL110_STOCK) {
 goto control;
 }
 imsc:
@@ -445,7 +445,7 @@ static void pl110_write(void *opaque, hwaddr offset,
 pl110_update(s);
 break;
 case 7: /* LCDControl */
-if (s->version != PL110) {
+if (s->version != PL110_STOCK) {
 goto imsc;
 }
 control:
@@ -513,7 +513,7 @@ static void pl110_init(Object *obj)
 {
 PL110State *s = PL110(obj);
 
-s->version = PL110;
+s->version = PL110_STOCK;
 }
 
 static void pl110_versatile_init(Object *obj)
-- 
2.26.2

[PATCH 05/41] aspeed_timer: Fix ASPEED_TIMER macro definition

The macro definition had an extra semicolon.  This was never
noticed because the macro was only being used where it didn't
make a difference.

Signed-off-by: Eduardo Habkost 
---
 include/hw/timer/aspeed_timer.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
index 948329893c..d7c7d8ad28 100644
--- a/include/hw/timer/aspeed_timer.h
+++ b/include/hw/timer/aspeed_timer.h
@@ -26,7 +26,7 @@
 #include "hw/misc/aspeed_scu.h"
 
 #define ASPEED_TIMER(obj) \
-OBJECT_CHECK(AspeedTimerCtrlState, (obj), TYPE_ASPEED_TIMER);
+OBJECT_CHECK(AspeedTimerCtrlState, (obj), TYPE_ASPEED_TIMER)
 #define TYPE_ASPEED_TIMER "aspeed.timer"
 #define TYPE_ASPEED_2400_TIMER TYPE_ASPEED_TIMER "-ast2400"
 #define TYPE_ASPEED_2500_TIMER TYPE_ASPEED_TIMER "-ast2500"
-- 
2.26.2

Re: [PATCH] spapr/xive: Use xive_source_esb_len()

2020-08-13 Thread Greg Kurz

On Thu, 13 Aug 2020 17:38:59 -0300
Gustavo Romero  wrote:

> Hi Greg,
> 

Hi Gustavo,

> On 8/13/20 2:28 PM, Greg Kurz wrote:
> > static inline size_t xive_source_esb_len(XiveSource *xsrc)
> > {
> >  return (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
> > }
> > 
> > Signed-off-by: Greg Kurz 
> > ---
> > Follow-up on "ppc/xive: Rework setup of XiveSource::esb_mmio"
> > http://patchwork.ozlabs.org/project/qemu-devel/patch/159679992680.876294.7520540158586170894.st...@bahia.lan/
> > ---
> >   hw/intc/spapr_xive.c |2 +-
> >   hw/intc/spapr_xive_kvm.c |2 +-
> >   2 files changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
> > index 3c84f64dc464..4bd0d606ba17 100644
> > --- a/hw/intc/spapr_xive.c
> > +++ b/hw/intc/spapr_xive.c
> > @@ -336,7 +336,7 @@ static void spapr_xive_realize(DeviceState *dev, Error 
> > **errp)
> >   sysbus_init_mmio(SYS_BUS_DEVICE(xive), _xsrc->esb_mmio);
> >   
> >   /* Set the mapping address of the END ESB pages after the source ESBs 
> > */
> > -xive->end_base = xive->vc_base + (1ull << xsrc->esb_shift) * 
> > xsrc->nr_irqs;
> > +xive->end_base = xive->vc_base + xive_source_esb_len(xsrc);
> >   
> >   /*
> >* Allocate the routing tables
> > diff --git a/hw/intc/spapr_xive_kvm.c b/hw/intc/spapr_xive_kvm.c
> > index 82a6f99f022d..3263b982239a 100644
> > --- a/hw/intc/spapr_xive_kvm.c
> > +++ b/hw/intc/spapr_xive_kvm.c
> > @@ -831,7 +831,7 @@ void kvmppc_xive_disconnect(SpaprInterruptController 
> > *intc)
> >   
> >   /* Clear the KVM mapping */
> >   xsrc = >source;
> > -esb_len = (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
> > +esb_len = xive_source_esb_len(xsrc);
> 
> hrm I'd like to not add another level of indirection here.
> In this specific case I think it's more clear to read just
> 
> 1ull << xsrc->esb_shift) * xsrc->nr_irqs
> 
> and get the idea of one IRQ per ESB page (or pair of pages,
> for trigger and management), than one having to look at
> what is inside "a box" called xive_source_esb_len().
> 
> Wrapping it under another function doesn't help more when
> reading the code, XIVE is already tricky enough :)
> 

Heh, XIVE is tricky enough that only a few people will dare
to touch this code and they'd better already know about the
one IRQ per ESB page thingy ;-)

More seriously, this is a matter of taste, but since you're likely
to be involved in XIVE a bit more than me, I'm perfectly fine with
keeping this open-coded.

> 
> Cheers,
> Gustavo
> 
> PS: It seems something messed up with the commit message. It
> can be that the ML did that tho...

It's more laziness on my side... I should have come up with a
proper changelog like "We already have an helper that provides
the length of the ESB mapping. No need to open-code this again."
instead of pasting a code snippet. Time to go on vacation I guess :)

Cheers,

--
Greg

Re: [PATCH 01/14] spapr: Simplify error handling in spapr_phb_realize()

2020-08-13 Thread Greg Kurz

On Thu, 13 Aug 2020 16:57:04 -0300
Daniel Henrique Barboza  wrote:

> Greg,
> 
> This patch is breaking guest startup in ppc-for-5.2 for me. The process
> gives an almost instant segfault. Here's what I'm doing:
> 

Ok, this is because this patch should have been applied after
the "spapr: Cleanups for XIVE" series:

http://patchwork.ozlabs.org/project/qemu-devel/cover/159679991916.876294.8967140647442842745.st...@bahia.lan/

specifically this patch:

http://patchwork.ozlabs.org/project/qemu-devel/patch/159679993438.876294.7285654331498605426.st...@bahia.lan/

which prevents of a bogus error path in kvmppc_xive_source_reset_one() to
be taken:

/* The KVM XIVE device is not in use */
if (xive->fd == -1) {
return -ENODEV; <== this should return 0 to avoid the segfault, but
the real issue is that kvmppc_xive_*() calls
shouldn't be called at all when we don't have
a KVM XIVE device. This is the purpose of the
"spapr: Cleanups for XIVE" series.
}

I should maybe have added some Based-on: tag to make it clearer...

David,

Can you apply the series the other way around ?

First :

"spapr: Cleanups for XIVE"

http://patchwork.ozlabs.org/project/qemu-devel/cover/159679991916.876294.8967140647442842745.st...@bahia.lan/

Then :

"ppc/spapr: Error handling fixes and cleanups"

http://patchwork.ozlabs.org/project/qemu-devel/cover/159707843034.1489912.1082061742626355958.st...@bahia.lan/

Sorry everyone for the inconvenience.

Cheers,

--
Greg

> $ sudo ./qemu-system-ppc64 -machine 
> pseries-5.1,accel=kvm,usb=off,dump-guest-core=off -m 65536\
> -overcommit mem-lock=off -smp 4,sockets=4,cores=1,threads=1 -rtc base=utc 
> -display none -vga none -nographic -boot menu=on \
> -device spapr-pci-host-bridge,index=1,id=pci.1 -device 
> spapr-pci-host-bridge,index=2,id=pci.2 \
> -device spapr-pci-host-bridge,index=3,id=pci.3 -device 
> spapr-pci-host-bridge,index=4,id=pci.4 \
> -device qemu-xhci,id=usb,bus=pci.0,addr=0x2 \
> -drive 
> file=/home/danielhb/f32.qcow2,format=qcow2,if=none,id=drive-virtio-disk0 \
> -device 
> virtio-blk-pci,scsi=off,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1
>  \
> -device usb-kbd,id=input0,bus=usb.0,port=1 -device 
> usb-mouse,id=input1,bus=usb.0,port=2 \
> -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x4 -msg timestamp=on \
> -machine cap-ccf-assist=off
> Segmentation fault
> $
> 
> 
> GDB points this backtrace:
> 
> Thread 1 "qemu-system-ppc" received signal SIGSEGV, Segmentation fault.
> error_vprepend (errp=0x7fffe400, fmt=0x100ec2698 "can't allocate LSIs: ", 
> ap=0x7fffe290 "\030") at /home/danielhb/qemu/util/error.c:134
> 134 g_string_append(newmsg, (*errp)->msg);
> Missing separate debuginfos, use: dnf debuginfo-install 
> glib2-2.64.4-1.fc32.ppc64le libblkid-2.35.2-1.fc32.ppc64le 
> libffi-3.1-24.fc32.ppc64le libgcrypt-1.8.5-3.fc32.ppc64le 
> libgpg-error-1.36-3.fc32.ppc64le libmount-2.35.2-1.fc32.ppc64le 
> libselinux-3.0-5.fc32.ppc64le libxml2-2.9.10-3.fc32.ppc64le 
> ncurses-libs-6.1-15.20191109.fc32.ppc64le numactl-libs-2.0.12-4.fc32.ppc64le 
> pcre-8.44-1.fc32.ppc64le pcre2-10.35-4.fc32.ppc64le 
> pixman-0.40.0-1.fc32.ppc64le xz-libs-5.2.5-1.fc32.ppc64le 
> zlib-1.2.11-21.fc32.ppc64le
> (gdb) bt
> #0  error_vprepend (errp=0x7fffe400, fmt=0x100ec2698 "can't allocate 
> LSIs: ", ap=0x7fffe290 "\030") at /home/danielhb/qemu/util/error.c:134
> #1  0x000100c1e9cc in error_prepend (errp=0x7fffe400, fmt=0x100ec2698 
> "can't allocate LSIs: ") at /home/danielhb/qemu/util/error.c:144
> #2  0x0001004cdad4 in spapr_phb_realize (dev=0x101d6cb90, 
> errp=0x7fffe400) at /home/danielhb/qemu/hw/ppc/spapr_pci.c:1982
> #3  0x000100735f70 in device_set_realized (obj=0x101d6cb90, value=true, 
> errp=0x7fffe568) at /home/danielhb/qemu/hw/core/qdev.c:864
> #4  0x000100a5aae4 in property_set_bool (obj=0x101d6cb90, v=0x101d6daa0, 
> name=0x100f13df8 "realized", opaque=0x1016d2430, errp=0x7fffe568) at 
> /home/danielhb/qemu/qom/object.c:2202
> #5  0x000100a57d64 in object_property_set (obj=0x101d6cb90, 
> name=0x100f13df8 "realized", v=0x101d6daa0, errp=0x1016156c0 ) 
> at /home/danielhb/qemu/qom/object.c:1349
> #6  0x000100a5cb38 in object_property_set_qobject (obj=0x101d6cb90, 
> name=0x100f13df8 "realized", value=0x101d6c950, errp=0x1016156c0 
> )
>  at /home/danielhb/qemu/qom/qom-qobject.c:28
> #7  0x000100a581fc in object_property_set_bool (obj=0x101d6cb90, 
> name=0x100f13df8 "realized", value=true, errp=0x1016156c0 ) at 
> /home/danielhb/qemu/qom/object.c:1416
> #8  0x000100734178 in qdev_realize (dev=0x101d6cb90, bus=0x10198e250, 
> errp=0x1016156c0 ) at /home/danielhb/qemu/hw/core/qdev.c:379
> #9  0x0001007341dc in qdev_realize_and_unref (dev=0x101d6cb90, 
> bus=0x10198e250, errp=0x1016156c0 ) at 
> /home/danielhb/qemu/hw/core/qdev.c:386
> #10 0x0001007463c0 in

Re: [RFC PATCH v2 1/2] hw/riscv: sifive_u: Add file-backed OTP.

On Wed, Aug 12, 2020 at 9:12 PM Green Wan  wrote:
>
> Hi Alistair,
>
> Thanks for the feedback and tips. Not sure whether I get it right. I gave a 
> try with -drive and -device options as below.
>
> $ qemu-system-riscv64 -M sifive_u -drive if=none,format=raw,file=otp.img 
> -device riscv.sifive.u.otp
> qemu-system-riscv64: -device riscv.sifive.u.otp: Parameter 'driver' expects 
> pluggable device type

You don't need the -device, -drive should be enough (and then the OTP
device needs to be re-written to support it).

Alistair

>
> Then I dump "info qtree". The device, "riscv.sifive.u.otp", belongs to 
> 'System' bus. (dump list by 'info qdm') and all devices on 'System' bus seem 
> not available with "-device". Any suggestions for specifying the device?
>
> Thanks,
> - Green
>
> On Tue, Aug 11, 2020 at 6:24 AM Alistair Francis  wrote:
>>
>> ,()On Thu, Jul 30, 2020 at 7:49 PM Green Wan  wrote:
>> >
>> > Add a file-backed implementation for OTP of sifive_u machine. The
>> > machine property for file-backed is disabled in default. Do file
>> > open, mmap and close for every OTP read/write in case keep the
>> > update-to-date snapshot of OTP.
>>
>> I don't think this is the correct way to write to the file.
>>
>> QEMU has backends that should do this for you. For example QEMU
>> includes the -blockdev/-driver or -mtdblock command line arguments.
>>
>> This implementation should look more like an SD card in terms of
>> interface. You will probably want to call drive_get_next() (probably
>> with IF_MTD, but that's up to you).
>>
>> The hw/arm/xlnx-zcu102.c file has a good example of attaching an SD
>> card by setting the drive property.
>>
>> Alistair
>>
>> >
>> > Signed-off-by: Green Wan 
>> > ---
>> >  hw/riscv/sifive_u.c | 26 +++
>> >  hw/riscv/sifive_u_otp.c | 83 +
>> >  include/hw/riscv/sifive_u.h |  2 +
>> >  include/hw/riscv/sifive_u_otp.h |  1 +
>> >  4 files changed, 112 insertions(+)
>> >
>> > diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
>> > index e5682c38a9..c818496918 100644
>> > --- a/hw/riscv/sifive_u.c
>> > +++ b/hw/riscv/sifive_u.c
>> > @@ -87,6 +87,7 @@ static const struct MemmapEntry {
>> >  };
>> >
>> >  #define OTP_SERIAL  1
>> > +#define OTP_FILE"NULL"
>> >  #define GEM_REVISION0x10070109
>> >
>> >  static void create_fdt(SiFiveUState *s, const struct MemmapEntry *memmap,
>> > @@ -387,6 +388,8 @@ static void sifive_u_machine_init(MachineState 
>> > *machine)
>> >  object_initialize_child(OBJECT(machine), "soc", >soc, 
>> > TYPE_RISCV_U_SOC);
>> >  object_property_set_uint(OBJECT(>soc), "serial", s->serial,
>> >   _abort);
>> > +object_property_set_str(OBJECT(>soc), "otp-file", s->otp_file,
>> > + _abort);
>> >  qdev_realize(DEVICE(>soc), NULL, _abort);
>> >
>> >  /* register RAM */
>> > @@ -526,6 +529,21 @@ static void sifive_u_machine_set_uint32_prop(Object 
>> > *obj, Visitor *v,
>> >  visit_type_uint32(v, name, (uint32_t *)opaque, errp);
>> >  }
>> >
>> > +static void sifive_u_machine_get_str_prop(Object *obj, Visitor *v,
>> > + const char *name, void 
>> > *opaque,
>> > + Error **errp)
>> > +{
>> > +visit_type_str(v, name, (char **)opaque, errp);
>> > +}
>> > +
>> > +static void sifive_u_machine_set_str_prop(Object *obj, Visitor *v,
>> > + const char *name, void 
>> > *opaque,
>> > + Error **errp)
>> > +{
>> > +visit_type_str(v, name, (char **)opaque, errp);
>> > +}
>> > +
>> > +
>> >  static void sifive_u_machine_instance_init(Object *obj)
>> >  {
>> >  SiFiveUState *s = RISCV_U_MACHINE(obj);
>> > @@ -551,6 +569,12 @@ static void sifive_u_machine_instance_init(Object 
>> > *obj)
>> >  sifive_u_machine_get_uint32_prop,
>> >  sifive_u_machine_set_uint32_prop, NULL, 
>> > >serial);
>> >  object_property_set_description(obj, "serial", "Board serial number");
>> > +
>> > +s->otp_file = (char *)OTP_FILE;
>> > +object_property_add(obj, "otp-file", "string",
>> > +sifive_u_machine_get_str_prop,
>> > +sifive_u_machine_set_str_prop, NULL, 
>> > >otp_file);
>> > +object_property_set_description(obj, "otp-file", "file-backed otp 
>> > file");
>> >  }
>> >
>> >  static void sifive_u_machine_class_init(ObjectClass *oc, void *data)
>> > @@ -709,6 +733,7 @@ static void sifive_u_soc_realize(DeviceState *dev, 
>> > Error **errp)
>> >  }
>> >
>> >  qdev_prop_set_uint32(DEVICE(>otp), "serial", s->serial);
>> > +qdev_prop_set_string(DEVICE(>otp), "otp-file", s->otp_file);
>> >  if (!sysbus_realize(SYS_BUS_DEVICE(>otp), errp)) {
>> >  return;
>> >  }
>> > @@ -737,6 +762,7 @@ static void

Re: [PATCH v3 00/13] RISC-V: Update the Hypervisor spec to v0.6.1

On Wed, Aug 12, 2020 at 7:26 PM LIU Zhiwei  wrote:
>
>
>
> On 2020/8/13 3:13, Alistair Francis wrote:
> > This series updates the experimental QEMU RISC-V Hypervisor spec to the
> > v0.6.1 draft implementation.
> >
> > THis includes support for the new 2-stage lookup instructions and the new
> > CSRs.
> >
> > It also includes the new 0.6.1 support for the virtual instruction
> > fault.
> >
> > This was tested by running 32-bit and 64-bit Xvisor on QEMU and starting
> > Linux guests.
> Hi Alistair,
>
> I am reading Christoper Dall's article on ARM virtualization.  As far as
> I can see,  Xvisor is type 1 hypervisor.

Yep, it's a bare metal Hypervisor.

>
> I want to  try this patch set. Could you share the method? Thanks very much.

There are some details in the origins submission, you can see them
here: https://patchew.org/QEMU/cover.1580518859.git.alistair.fran...@wdc.com/

I'm also working on improving the support in meta-virtualisation to
help as well.

Thanks for helping test.

Alistair

>
> Best Regards,
> Zhiwei
> > v3:
> >   - Rebase on master
> > v2:
> >   - Update to v0.6.1
> >
> >
> >
> > Alistair Francis (13):
> >target/riscv: Allow setting a two-stage lookup in the virt status
> >target/riscv: Allow generating hlv/hlvx/hsv instructions
> >target/riscv: Do two-stage lookups on hlv/hlvx/hsv instructions
> >target/riscv: Don't allow guest to write to htinst
> >target/riscv: Convert MSTATUS MTL to GVA
> >target/riscv: Fix the interrupt cause code
> >target/riscv: Update the Hypervisor trap return/entry
> >target/riscv: Update the CSRs to the v0.6 Hyp extension
> >target/riscv: Only support a single VSXL length
> >target/riscv: Only support little endian guests
> >target/riscv: Support the v0.6 Hypervisor extension CRSs
> >target/riscv: Return the exception from invalid CSR accesses
> >target/riscv: Support the Virtual Instruction fault
> >
> >   target/riscv/cpu.h  |   2 +
> >   target/riscv/cpu_bits.h |  25 +-
> >   target/riscv/helper.h   |   4 +
> >   target/riscv/insn32-64.decode   |   5 +
> >   target/riscv/insn32.decode  |  11 +
> >   target/riscv/cpu_helper.c   | 123 +
> >   target/riscv/csr.c  | 171 ++--
> >   target/riscv/insn_trans/trans_rvh.inc.c | 342 +++-
> >   target/riscv/op_helper.c| 176 +++-
> >   target/riscv/translate.c|  10 -
> >   10 files changed, 761 insertions(+), 108 deletions(-)
> >
>

Re: [RFC PATCH v2 7/7] util/vfio-helpers: Allow opening device requesting for multiple IRQs

On Thu, 13 Aug 2020 19:29:57 +0200
Philippe Mathieu-Daudé  wrote:

> Now that our helper is ready for handling multiple IRQs, let
> qemu_vfio_open_pci() take an 'irq_count' argument.
> 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---

As with patch 2/ tying IRQ setup with the opening of a device seems
wrong.  Get the device open, then create an interface to configure the
interrupt.  Thanks,

Alex


>  include/qemu/vfio-helpers.h | 2 +-
>  block/nvme.c| 5 -
>  util/vfio-helpers.c | 4 ++--
>  3 files changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/include/qemu/vfio-helpers.h b/include/qemu/vfio-helpers.h
> index 5c2d8ee5b3..4773b116df 100644
> --- a/include/qemu/vfio-helpers.h
> +++ b/include/qemu/vfio-helpers.h
> @@ -16,7 +16,7 @@
>  typedef struct QEMUVFIOState QEMUVFIOState;
>  
>  QEMUVFIOState *qemu_vfio_open_pci(const char *device, int irq_type,
> -  Error **errp);
> +  unsigned irq_count, Error **errp);
>  void qemu_vfio_close(QEMUVFIOState *s);
>  int qemu_vfio_dma_map(QEMUVFIOState *s, void *host, size_t size,
>bool temporary, uint64_t *iova_list);
> diff --git a/block/nvme.c b/block/nvme.c
> index a5ef571492..2d7aac3903 100644
> --- a/block/nvme.c
> +++ b/block/nvme.c
> @@ -106,6 +106,9 @@ QEMU_BUILD_BUG_ON(offsetof(NVMeRegs, doorbells) != 
> 0x1000);
>  #define INDEX_ADMIN 0
>  #define INDEX_IO(n) (1 + n)
>  
> +/* This driver shares a single MSIX IRQ for the admin and I/O queues */
> +#define MSIX_IRQ_COUNT  1
> +
>  struct BDRVNVMeState {
>  AioContext *aio_context;
>  QEMUVFIOState *vfio;
> @@ -712,7 +715,7 @@ static int nvme_init(BlockDriverState *bs, const char 
> *device, int namespace,
>  }
>  
>  s->vfio = qemu_vfio_open_pci(device, VFIO_PCI_MSIX_IRQ_INDEX,
> - errp);
> + MSIX_IRQ_COUNT, errp);
>  if (!s->vfio) {
>  ret = -EINVAL;
>  goto out;
> diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
> index 7a934d1a1b..36fafef0d3 100644
> --- a/util/vfio-helpers.c
> +++ b/util/vfio-helpers.c
> @@ -450,12 +450,12 @@ static void qemu_vfio_open_common(QEMUVFIOState *s)
>   * Open a PCI device, e.g. ":00:01.0".
>   */
>  QEMUVFIOState *qemu_vfio_open_pci(const char *device, int irq_type,
> -  Error **errp)
> +  unsigned irq_count, Error **errp)
>  {
>  int r;
>  QEMUVFIOState *s = g_new0(QEMUVFIOState, 1);
>  
> -r = qemu_vfio_init_pci(s, device, irq_type, 1, errp);
> +r = qemu_vfio_init_pci(s, device, irq_type, irq_count, errp);
>  if (r) {
>  g_free(s);
>  return NULL;

Re: [RFC PATCH v2 4/7] util/vfio-helpers: Check the device allow up to 'irq_count' IRQs

On Thu, 13 Aug 2020 19:29:54 +0200
Philippe Mathieu-Daudé  wrote:

> As we want to use more than one single IRQ, add a check that
> the device accept our request to use multiple IRQs.
> 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  util/vfio-helpers.c | 6 ++
>  util/trace-events   | 1 +
>  2 files changed, 7 insertions(+)
> 
> diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
> index bad60076f3..b81d4c70c2 100644
> --- a/util/vfio-helpers.c
> +++ b/util/vfio-helpers.c
> @@ -335,6 +335,12 @@ static int qemu_vfio_init_pci(QEMUVFIOState *s, const 
> char *device,
>  ret = -errno;
>  goto fail;
>  }
> +trace_qemu_vfio_init_pci(device_info.num_irqs);
> +if (device_info.num_irqs < irq_count) {
> +error_setg(errp, "Invalid device IRQ count");
> +ret = -EINVAL;
> +goto fail;
> +}

This is confusing the number of IRQ indexes (ie. IRQ types -
INTx/MSI/MSIx plus virtual interrupts like error reporting and device
request) with the number of sub-indexes available for a given type
again.  You actually need to look at VFIO_DEVICE_GET_IRQ_INFO for the
specified irq_type to see if it supports irq_count sub-indexes.

Maybe think of interrupts as a 2-dimensional array, we have:

INDEX   \  SUBINDEX
 \ 0 1 2 3 4 ... N
==
INTx  [0]| 
MSI   [1]|
MSI-X [2]|
...   [M]|

VFIO_DEVICE_GET_INFO only tells us essentially the last INDEX that the
device supports.  In order to learn about the number of SUBINDEXes, or
vectors, if any, that each INDEX provides, we need to look at
VFIO_DEVICE_GET_IRQ_INFO.  When we're wanting to probe support for some
number of concurrent device interrupt vectors, we need to look at the
vfio_irq_info.count value for the desired index, ie. the extent of the
entries in the row associated with our column index type.  Thanks,

Alex

>  s->irq_type = irq_type;
>  s->irq_count = irq_count;
>  
> diff --git a/util/trace-events b/util/trace-events
> index 0ce42822eb..2e8be3 100644
> --- a/util/trace-events
> +++ b/util/trace-events
> @@ -83,3 +83,4 @@ qemu_vfio_new_mapping(void *s, void *host, size_t size, int 
> index, uint64_t iova
>  qemu_vfio_do_mapping(void *s, void *host, size_t size, uint64_t iova) "s %p 
> host %p size %zu iova 0x%"PRIx64
>  qemu_vfio_dma_map(void *s, void *host, size_t size, bool temporary, uint64_t 
> *iova) "s %p host %p size %zu temporary %d iova %p"
>  qemu_vfio_dma_unmap(void *s, void *host) "s %p host %p"
> +qemu_vfio_init_pci(uint32_t count) "device interrupt count: %"PRIu32

Re: [RFC PATCH v2 6/7] util/vfio-helpers: Allow to set EventNotifier to particular IRQ

On Thu, 13 Aug 2020 19:29:56 +0200
Philippe Mathieu-Daudé  wrote:

> Let qemu_vfio_pci_init_irq() take an 'index' argument, so we can
> set the EventNotifier to a specific IRQ.
> Add a safety check. Since our helper is limited to one single IRQ
> we are safe.
> 
> Our only user is the NVMe block driver, update it (also safe because
> it only uses the first IRQ).
> 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  include/qemu/vfio-helpers.h |  2 +-
>  block/nvme.c|  2 +-
>  util/vfio-helpers.c | 11 +--
>  3 files changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/include/qemu/vfio-helpers.h b/include/qemu/vfio-helpers.h
> index 728f40922b..5c2d8ee5b3 100644
> --- a/include/qemu/vfio-helpers.h
> +++ b/include/qemu/vfio-helpers.h
> @@ -28,6 +28,6 @@ void *qemu_vfio_pci_map_bar(QEMUVFIOState *s, int index,
>  void qemu_vfio_pci_unmap_bar(QEMUVFIOState *s, int index, void *bar,
>   uint64_t offset, uint64_t size);
>  int qemu_vfio_pci_init_irq(QEMUVFIOState *s, EventNotifier *e,
> -   Error **errp);
> +   int irq_index, Error **errp);
>  
>  #endif
> diff --git a/block/nvme.c b/block/nvme.c
> index 21b0770c02..a5ef571492 100644
> --- a/block/nvme.c
> +++ b/block/nvme.c
> @@ -785,7 +785,7 @@ static int nvme_init(BlockDriverState *bs, const char 
> *device, int namespace,
>  }
>  }
>  
> -ret = qemu_vfio_pci_init_irq(s->vfio, >irq_notifier, errp);
> +ret = qemu_vfio_pci_init_irq(s->vfio, >irq_notifier, INDEX_ADMIN, 
> errp);
>  if (ret) {
>  goto out;
>  }
> diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
> index 5781e4f066..7a934d1a1b 100644
> --- a/util/vfio-helpers.c
> +++ b/util/vfio-helpers.c
> @@ -180,13 +180,20 @@ void qemu_vfio_pci_unmap_bar(QEMUVFIOState *s, int 
> index, void *bar,
>   * Initialize device IRQ with @irq_type and and register an event notifier.
>   */
>  int qemu_vfio_pci_init_irq(QEMUVFIOState *s, EventNotifier *e,
> -   Error **errp)
> +   int irq_index, Error **errp)
>  {
>  int r;
>  struct vfio_irq_set *irq_set;
>  size_t irq_set_size;
>  struct vfio_irq_info irq_info = { .argsz = sizeof(irq_info) };
>  
> +if (irq_index >= s->irq_count) {
> +error_setg(errp,
> +   "Illegal interrupt %d (device initialized for %zu in 
> total)",
> +   irq_index, s->irq_count);
> +return -EINVAL;
> +}
> +
>  irq_info.index = s->irq_type;
>  if (ioctl(s->device, VFIO_DEVICE_GET_IRQ_INFO, _info)) {
>  error_setg_errno(errp, errno, "Failed to get device interrupt info");
> @@ -196,7 +203,7 @@ int qemu_vfio_pci_init_irq(QEMUVFIOState *s, 
> EventNotifier *e,
>  error_setg(errp, "Device interrupt doesn't support eventfd");
>  return -EINVAL;
>  }
> -s->eventfd[0] = event_notifier_get_fd(e);
> +s->eventfd[irq_index] = event_notifier_get_fd(e);

This can't work.  For each fd in the array provided the kernel is going
to try to get that fd and configure it as an eventfd.  For each call
until we set all eventfd index {0..irq_count}, this SET_IRQS ioctl will
fail.  I would probably make that pre-configure function I referred to
earlier and create a single spurious interrupt eventfd and configure
all of the vectors to signal that one eventfd.  You could then have
this per vector callback swap the eventfd with the caller provided one
for the given vector.

NB, I don't know if you're going to run into trouble with this scheme
with the fact that devices can behave differently based on the number
of vectors they have enabled.  You're creating an interface for a
driver, so presumably that driver knows, for example, that as soon as
vector N is enabled, signaling for event foo moves from vector 0 to
vector N.  Thanks,

Alex

>  
>  irq_set_size = sizeof(*irq_set) + s->irq_count * sizeof(int32_t);
>  irq_set = g_malloc0(irq_set_size);

Re: [RFC PATCH v2 2/7] util/vfio-helpers: Move IRQ 'type' from pci_init_irq() to open_pci()

On Thu, 13 Aug 2020 19:29:52 +0200
Philippe Mathieu-Daudé  wrote:

> Once opened, we will used the same IRQ type for all our event
> notifiers, so pass the argument when we open the PCI device,
> store the IRQ type in the driver state, and directly use the
> value saved in the state each time we call qemu_vfio_pci_init_irq.
> 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---

This feels quite a bit strange to me, a PCI device can operate in one
of several interrupt modes, or without interrupts at all.  Why would we
force a user of this interface to define the interrupt type they'll use
in advance and then not even verify if the device supports that type?
A driver might want to fall back to a different interrupt type if the
one they want is not supported.  If we want to abstract this from the
driver then we should at least have an interface separate from the
initial open function that tells us to preconfigure some specified
number of vectors.  We could then have a preference policy that would
attempt to use MSI-X, followed by MSI, followed by INTx (assuming
request is for a single vector), based on what the device supports.
Then a driver could fallback to fewer interrupts if the device does not
support, or the host system cannot provide, the desired number of
interrupts.  Thanks,

Alex


>  include/qemu/vfio-helpers.h |  5 +++--
>  block/nvme.c|  6 +++---
>  util/vfio-helpers.c | 13 +
>  3 files changed, 15 insertions(+), 9 deletions(-)
> 
> diff --git a/include/qemu/vfio-helpers.h b/include/qemu/vfio-helpers.h
> index 1f057c2b9e..728f40922b 100644
> --- a/include/qemu/vfio-helpers.h
> +++ b/include/qemu/vfio-helpers.h
> @@ -15,7 +15,8 @@
>  
>  typedef struct QEMUVFIOState QEMUVFIOState;
>  
> -QEMUVFIOState *qemu_vfio_open_pci(const char *device, Error **errp);
> +QEMUVFIOState *qemu_vfio_open_pci(const char *device, int irq_type,
> +  Error **errp);
>  void qemu_vfio_close(QEMUVFIOState *s);
>  int qemu_vfio_dma_map(QEMUVFIOState *s, void *host, size_t size,
>bool temporary, uint64_t *iova_list);
> @@ -27,6 +28,6 @@ void *qemu_vfio_pci_map_bar(QEMUVFIOState *s, int index,
>  void qemu_vfio_pci_unmap_bar(QEMUVFIOState *s, int index, void *bar,
>   uint64_t offset, uint64_t size);
>  int qemu_vfio_pci_init_irq(QEMUVFIOState *s, EventNotifier *e,
> -   int irq_type, Error **errp);
> +   Error **errp);
>  
>  #endif
> diff --git a/block/nvme.c b/block/nvme.c
> index a61e86a83e..21b0770c02 100644
> --- a/block/nvme.c
> +++ b/block/nvme.c
> @@ -711,7 +711,8 @@ static int nvme_init(BlockDriverState *bs, const char 
> *device, int namespace,
>  return ret;
>  }
>  
> -s->vfio = qemu_vfio_open_pci(device, errp);
> +s->vfio = qemu_vfio_open_pci(device, VFIO_PCI_MSIX_IRQ_INDEX,
> + errp);
>  if (!s->vfio) {
>  ret = -EINVAL;
>  goto out;
> @@ -784,8 +785,7 @@ static int nvme_init(BlockDriverState *bs, const char 
> *device, int namespace,
>  }
>  }
>  
> -ret = qemu_vfio_pci_init_irq(s->vfio, >irq_notifier,
> - VFIO_PCI_MSIX_IRQ_INDEX, errp);
> +ret = qemu_vfio_pci_init_irq(s->vfio, >irq_notifier, errp);
>  if (ret) {
>  goto out;
>  }
> diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
> index 9cb9b553a5..f1196e43dc 100644
> --- a/util/vfio-helpers.c
> +++ b/util/vfio-helpers.c
> @@ -43,6 +43,8 @@ typedef struct {
>  struct QEMUVFIOState {
>  QemuMutex lock;
>  
> +int irq_type; /* vfio index */
> +
>  /* These fields are protected by BQL */
>  int container;
>  int group;
> @@ -176,14 +178,14 @@ void qemu_vfio_pci_unmap_bar(QEMUVFIOState *s, int 
> index, void *bar,
>   * Initialize device IRQ with @irq_type and and register an event notifier.
>   */
>  int qemu_vfio_pci_init_irq(QEMUVFIOState *s, EventNotifier *e,
> -   int irq_type, Error **errp)
> +   Error **errp)
>  {
>  int r;
>  struct vfio_irq_set *irq_set;
>  size_t irq_set_size;
>  struct vfio_irq_info irq_info = { .argsz = sizeof(irq_info) };
>  
> -irq_info.index = irq_type;
> +irq_info.index = s->irq_type;
>  if (ioctl(s->device, VFIO_DEVICE_GET_IRQ_INFO, _info)) {
>  error_setg_errno(errp, errno, "Failed to get device interrupt info");
>  return -errno;
> @@ -237,6 +239,7 @@ static int qemu_vfio_pci_write_config(QEMUVFIOState *s, 
> void *buf, int size, int
>  }
>  
>  static int qemu_vfio_init_pci(QEMUVFIOState *s, const char *device,
> +  int irq_type,
>Error **errp)
>  {
>  int ret;
> @@ -331,6 +334,7 @@ static int qemu_vfio_init_pci(QEMUVFIOState *s, const 
> char *device,
>  ret = -errno;
>  goto fail;
>  }
> +s->irq_type = irq_type;
>  
>

Re: [PULL 05/20] target/riscv: Check nanboxed inputs in trans_rvf.inc.c

On Thu, Aug 13, 2020 at 9:48 AM Richard Henderson
 wrote:
>
> On 8/13/20 7:46 AM, Alistair Francis wrote:
> >> Hi Alistair,
> >>
> >> As Chih-Min said, it's wrong here.  He has given the correct patch code
> >> https://www.mail-archive.com/qemu-devel@nongnu.org/msg728540.html
> >>
> >> We can either  squash the code to this patch or add an separate patch
> >> later. I prefer the former.
> >> Thanks very much.
> >
> > Richard are you ok if I squash this diff into the patch and send a PR v2?
> >
> > diff --git a/target/riscv/insn_trans/trans_rvf.inc.c
> > b/target/riscv/insn_trans/trans_rvf.inc.c
> > index f9a9e0643a..76f281d275 100644
> > --- a/target/riscv/insn_trans/trans_rvf.inc.c
> > +++ b/target/riscv/insn_trans/trans_rvf.inc.c
> > @@ -201,7 +201,8 @@ static bool trans_fsgnjn_s(DisasContext *ctx,
> > arg_fsgnjn_s *a)
> >   * This formulation retains the nanboxing of rs1.
> >   */
> >  mask = tcg_const_i64(~MAKE_64BIT_MASK(31, 1));
> > -tcg_gen_andc_i64(rs2, mask, rs2);
> > +tcg_gen_not_i64(rs2, rs2); // forget to inverse rs2
> > +tcg_gen_andc_i64(rs2, rs2, mask);  //mask needs to be
>
> Ah, well.  Yes, it's a bug.  However,
>
>~rs2 & ~mask
> = ~(rs2 | mask)
>
> so a better fix could be
>
> -tcg_gen_andc_i64(rs2, mask, rs2);
> +tcg_gen_nor_i64(rs2, rs2, mask);

Fixed.

Alistair

>
>
> As an aside, I think perhaps I should have added a ppc-style rotate-and-insert
> primitive to handle this sort of bitfield insert, since the best set of host
> insns to perform this operation, when the start of the field is not bit 0, is
> difficult to predict from the translator.
>
>
> r~

RE: [PATCH v3 2/3] hw/i386: Add a new check to configure smp dies for EPYC

2020-08-13 Thread Babu Moger




> -Original Message-
> From: Igor Mammedov 
> Sent: Thursday, August 13, 2020 8:56 AM
> To: Moger, Babu 
> Cc: Daniel P. Berrangé ; ehabk...@redhat.com;
> m...@redhat.com; qemu-devel@nongnu.org; pbonz...@redhat.com;
> r...@twiddle.net
> Subject: Re: [PATCH v3 2/3] hw/i386: Add a new check to configure smp dies for
> EPYC
> 
> On Tue, 11 Aug 2020 16:03:58 -0500
> Babu Moger  wrote:
> 
> > On 8/7/20 2:11 PM, Igor Mammedov wrote:
> > > On Fri, 7 Aug 2020 17:52:22 +0100
> > > Daniel P. Berrangé  wrote:
> > >
> > >> On Fri, Aug 07, 2020 at 11:32:51AM -0500, Babu Moger wrote:
> > >>> Adding a new check to warn the users to configure 'dies' when
> > >>> topology is numa configured. It makes it easy to build the
> > >>> topology for EPYC models.
> > >>
> > >> This says you're adding a warning
> > >>
> > >>>
> > >>> Signed-off-by: Babu Moger 
> > >>> ---
> > >>>  hw/i386/x86.c |7 +++
> > >>>  1 file changed, 7 insertions(+)
> > >>>
> > >>> diff --git a/hw/i386/x86.c b/hw/i386/x86.c index
> > >>> 67bee1bcb8..2a6ce56ef1 100644
> > >>> --- a/hw/i386/x86.c
> > >>> +++ b/hw/i386/x86.c
> > >>> @@ -138,6 +138,13 @@ void x86_cpus_init(X86MachineState *x86ms,
> > >>> int default_cpu_version)
> > >>>
> > >>>  /* Check for apicid encoding */
> > >>>  if (cpu_x86_use_epyc_apic_id_encoding(ms->cpu_type)) {
> > >>> +if ((ms->numa_state->num_nodes > 0) &&
> > >>> +ms->numa_state->num_nodes != (ms->smp.sockets * x86ms-
> >smp_dies)) {
> > >>> +error_setg(_fatal, "Numa configuration requires smp 
> > >>> 'dies' "
> > >>> +   "parameter. Configure the cpu topology properly 
> > >>> with "
> > >>> +   "max_cpus = sockets * dies * cores * threads");
> > >>
> > >> ...but you're actually making this a fatal error, not a warning.
> > >>
> > >> I'm not sure this is really OK. Wouldn't this mean that existing
> > >> VMs deployed today, risk triggering this fatal error next time they
> > >> are booted, or live migrated.  If it is possible someone is using
> > >> such a config today, I don't think we can break it.
> > >
> > > to begin with, users shouldn't have used 'dies' with initial impl. at all.
> > > (it was Intel introduced option and EPYC's added very similar
> > > internal node_id (removed by the next patch)).
> > > Now we are trying to consolidate this mess and reuse dies for EPYC.
> > >
> > > EPYC was out in the since with 5.0 (though broken), users could
> > > start a VM with such config but that would not be correct EPYC from apicid
> and cpuid point of view.
> > > Guest OS might run if it doesn't know about EPYCs or behave wierdly
> > > (sub optimal|crash|whatever) on seeing unexpected values.
> > >
> > > If we are hell bound on keeping bugs of initial impl, then we should
> > > keep it to 5.1<= machine version and do the right thing for newer ones.
> > > Though I'm not sure we should keep broken variant around (all we
> > > would get from it is bug reports*/complains from users with end result of
> their config anyways).
> > > I'd rather error out with clear error message so user could fix their 
> > > broken
> config.
> > >
> > > *) there is at least one thread/bz on qemu-devel where users are
> > > trying to run with EPYC and pick up options combination so it would 
> > > produce
> sensible topology.
> >
> >
> > I am still not sure what is the right approach here.  I can think of
> > couple of options.
> > 1. If smp_dies != num_nodes then go ahead create the configuration
> > with as  many smp_dies and warn(but not error out) users about the mis-
> configuration.
> warning is a bad idea, that usually leads to troubles down the road.
> 
> Provided that code is relatively new and produces misconfigured CPUs and if
> nobody insists on keeping bug around, I'd try to go for erroring out.
> Yes that would break misconfigured configs but that could be fixed by
> reconfiguring on user side.

Ok. I will refresh the patches if there are no other comments. thanks

> 
> > 2. Introduce it as a fix based on  machine version(5.1 >) like Igor
> > mentioned. I am not sure how to achieve that. I can look into that.
> That's a headache for maintaing point of view, so again if nobody insist I'd
> rather avoid it.
> 
> >
> > Thanks
> > Babu
> >
> > >
> > >
> > >> Regards,
> > >> Daniel
> > >
> >

Re: [PATCH 1/1] target/arm: adjust CPTR_EL2 according to HCR_EL2.E2H

On 8/10/20 11:07 PM, LIU Zhiwei wrote:
>  if (el <= 2 && !arm_is_secure_below_el3(env)) {
> -if (env->cp15.cptr_el[2] & CPTR_TZ) {
> -return 2;
> -}
> -if (env->cp15.cptr_el[2] & CPTR_TFP) {
> -return 0;
> +if ((arm_hcr_el2_eff(env) & HCR_E2H) == HCR_E2H) {
> +int zen = extract32(env->cp15.cptr_el[2], 16, 2);
> +switch (zen) {
> +case 0:
> +case 2:
> +return 2;
> +case 1:
> +if ((arm_hcr_el2_eff(env) & HCR_TGE) == HCR_TGE) {

Since the outer if checks that we're in non-secure state, and (by nature of
sve) we know we're in aarch64 mode, then we don't need to use arm_hcr_el2_eff
and can just use env->cp15.hcr_el2.

Add a comment

> /* Since we exclude secure first, we may read HCR_EL2 directly. */

like we do in vae1_tlbmask.

You do not need to write

if ((x & bit) == bit)

just use

if (x & bit)

here.

With those changes,
Reviewed-by: Richard Henderson 


r~

[PATCH v3 0/1] cputlb: Make store_helper less fragile to compiler optimizations

This is the patch I posted in reply to Shu-Chun Weng's v2 at

https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg07589.html

with the patch comment adjusted.  The patch itself got an official R-b
from Alex, and an informal ack from Shu-Chun.

I plan to include this in tcg-next for 5.2.


r~


Richard Henderson (1):
  cputlb: Make store_helper less fragile to compiler optimizations

 accel/tcg/cputlb.c | 138 ++---
 1 file changed, 79 insertions(+), 59 deletions(-)

-- 
2.25.1

[PATCH v3 1/1] cputlb: Make store_helper less fragile to compiler optimizations

This has no functional change.

The current function structure is:

inline QEMU_ALWAYSINLINE
store_memop() {
switch () {
...
default:
qemu_build_not_reached();
}
}
inline QEMU_ALWAYSINLINE
store_helper() {
...
if (span_two_pages_or_io) {
...
helper_ret_stb_mmu();
}
store_memop();
}
helper_ret_stb_mmu() {
store_helper();
}

Whereas GCC will generate an error at compile-time when an always_inline
function is not inlined, Clang does not.  Nor does Clang prioritize the
inlining of always_inline functions.  Both of these are arguably bugs.

Both `store_memop` and `store_helper` need to be inlined and allow
constant propogations to eliminate the `qemu_build_not_reached` call.

However, if the compiler instead chooses to inline helper_ret_stb_mmu
into store_helper, then store_helper is now self-recursive and the
compiler is no longer able to propagate the constant in the same way.

This does not produce at current QEMU head, but was reproducible
at v4.2.0 with `clang-10 -O2 -fexperimental-new-pass-manager`.

The inline recursion problem can be fixed solely by marking
helper_ret_stb_mmu as noinline, so the compiler does not make an
incorrect decision about which functions to inline.

In addition, extract store_helper_unaligned as a noinline subroutine
that can be shared by all of the helpers.  This saves about 6k code
size in an optimized x86_64 build.

Reported-by: Shu-Chun Weng 
Reviewed-by: Alex Bennée 
Signed-off-by: Richard Henderson 
---
 accel/tcg/cputlb.c | 138 ++---
 1 file changed, 79 insertions(+), 59 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 5698292749..7e603d 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2009,6 +2009,80 @@ store_memop(void *haddr, uint64_t val, MemOp op)
 }
 }
 
+static void __attribute__((noinline))
+store_helper_unaligned(CPUArchState *env, target_ulong addr, uint64_t val,
+   uintptr_t retaddr, size_t size, uintptr_t mmu_idx,
+   bool big_endian)
+{
+const size_t tlb_off = offsetof(CPUTLBEntry, addr_write);
+uintptr_t index, index2;
+CPUTLBEntry *entry, *entry2;
+target_ulong page2, tlb_addr, tlb_addr2;
+TCGMemOpIdx oi;
+size_t size2;
+int i;
+
+/*
+ * Ensure the second page is in the TLB.  Note that the first page
+ * is already guaranteed to be filled, and that the second page
+ * cannot evict the first.
+ */
+page2 = (addr + size) & TARGET_PAGE_MASK;
+size2 = (addr + size) & ~TARGET_PAGE_MASK;
+index2 = tlb_index(env, mmu_idx, page2);
+entry2 = tlb_entry(env, mmu_idx, page2);
+
+tlb_addr2 = tlb_addr_write(entry2);
+if (!tlb_hit_page(tlb_addr2, page2)) {
+if (!victim_tlb_hit(env, mmu_idx, index2, tlb_off, page2)) {
+tlb_fill(env_cpu(env), page2, size2, MMU_DATA_STORE,
+ mmu_idx, retaddr);
+index2 = tlb_index(env, mmu_idx, page2);
+entry2 = tlb_entry(env, mmu_idx, page2);
+}
+tlb_addr2 = tlb_addr_write(entry2);
+}
+
+index = tlb_index(env, mmu_idx, addr);
+entry = tlb_entry(env, mmu_idx, addr);
+tlb_addr = tlb_addr_write(entry);
+
+/*
+ * Handle watchpoints.  Since this may trap, all checks
+ * must happen before any store.
+ */
+if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
+cpu_check_watchpoint(env_cpu(env), addr, size - size2,
+ env_tlb(env)->d[mmu_idx].iotlb[index].attrs,
+ BP_MEM_WRITE, retaddr);
+}
+if (unlikely(tlb_addr2 & TLB_WATCHPOINT)) {
+cpu_check_watchpoint(env_cpu(env), page2, size2,
+ env_tlb(env)->d[mmu_idx].iotlb[index2].attrs,
+ BP_MEM_WRITE, retaddr);
+}
+
+/*
+ * XXX: not efficient, but simple.
+ * This loop must go in the forward direction to avoid issues
+ * with self-modifying code in Windows 64-bit.
+ */
+oi = make_memop_idx(MO_UB, mmu_idx);
+if (big_endian) {
+for (i = 0; i < size; ++i) {
+/* Big-endian extract.  */
+uint8_t val8 = val >> (((size - 1) * 8) - (i * 8));
+helper_ret_stb_mmu(env, addr + i, val8, oi, retaddr);
+}
+} else {
+for (i = 0; i < size; ++i) {
+/* Little-endian extract.  */
+uint8_t val8 = val >> (i * 8);
+helper_ret_stb_mmu(env, addr + i, val8, oi, retaddr);
+}
+}
+}
+
 static inline void QEMU_ALWAYS_INLINE
 store_helper(CPUArchState *env, target_ulong addr, uint64_t val,
  TCGMemOpIdx oi, uintptr_t retaddr, MemOp op)
@@ -2097,64 +2171,9 @@ store_helper(CPUArchState *env, target_ulong addr, 
uint64_t val,
 if (size > 1
 && unlikely((addr & ~TARGET_PAGE_MASK) + size - 1

Re: [PATCH] spapr/xive: Use xive_source_esb_len()

2020-08-13 Thread Gustavo Romero


Hi Greg,

On 8/13/20 2:28 PM, Greg Kurz wrote:

static inline size_t xive_source_esb_len(XiveSource *xsrc)
{
 return (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
}

Signed-off-by: Greg Kurz 
---
Follow-up on "ppc/xive: Rework setup of XiveSource::esb_mmio"
http://patchwork.ozlabs.org/project/qemu-devel/patch/159679992680.876294.7520540158586170894.st...@bahia.lan/
---
  hw/intc/spapr_xive.c |2 +-
  hw/intc/spapr_xive_kvm.c |2 +-
  2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index 3c84f64dc464..4bd0d606ba17 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -336,7 +336,7 @@ static void spapr_xive_realize(DeviceState *dev, Error 
**errp)
  sysbus_init_mmio(SYS_BUS_DEVICE(xive), _xsrc->esb_mmio);
  
  /* Set the mapping address of the END ESB pages after the source ESBs */

-xive->end_base = xive->vc_base + (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
+xive->end_base = xive->vc_base + xive_source_esb_len(xsrc);
  
  /*

   * Allocate the routing tables
diff --git a/hw/intc/spapr_xive_kvm.c b/hw/intc/spapr_xive_kvm.c
index 82a6f99f022d..3263b982239a 100644
--- a/hw/intc/spapr_xive_kvm.c
+++ b/hw/intc/spapr_xive_kvm.c
@@ -831,7 +831,7 @@ void kvmppc_xive_disconnect(SpaprInterruptController *intc)
  
  /* Clear the KVM mapping */

  xsrc = >source;
-esb_len = (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
+esb_len = xive_source_esb_len(xsrc);


hrm I'd like to not add another level of indirection here.
In this specific case I think it's more clear to read just

1ull << xsrc->esb_shift) * xsrc->nr_irqs

and get the idea of one IRQ per ESB page (or pair of pages,
for trigger and management), than one having to look at
what is inside "a box" called xive_source_esb_len().

Wrapping it under another function doesn't help more when
reading the code, XIVE is already tricky enough :)


Cheers,
Gustavo

PS: It seems something messed up with the commit message. It
can be that the ML did that tho...

Re: [PATCH] hw: virtio-gpu: remove duplicated 'virtqueue_pop'

2020-08-13 Thread Laszlo Ersek

On 08/13/20 17:36, Li Qiang wrote:
> Just use 'while (true)' to avoid duplicated.
> No function change.
> 
> Signed-off-by: Li Qiang 
> ---
>  hw/display/virtio-gpu.c | 8 +---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> index 5f0dd7c150..9cef313f5e 100644
> --- a/hw/display/virtio-gpu.c
> +++ b/hw/display/virtio-gpu.c
> @@ -869,13 +869,15 @@ static void virtio_gpu_handle_ctrl(VirtIODevice *vdev, 
> VirtQueue *vq)
>  }
>  #endif
>  
> -cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
> -while (cmd) {
> +while (true) {
> +cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
> +if (!cmd) {
> +break;
> +}
>  cmd->vq = vq;
>  cmd->error = 0;
>  cmd->finished = false;
>  QTAILQ_INSERT_TAIL(>cmdq, cmd, next);
> -cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command));
>  }
>  
>  virtio_gpu_process_cmdq(g);
> 

There are (at least) three styles:

(1)

thing = get_next();
while (is_valid(thing)) {
...
thing = get_next();
}

(2)

while (true) {
thing = get_next();
if (!is_valid(thing)) {
break;
}
...
 }

(3)

while (is_valid(thing = get_next())) {
...
}

My opinion:

- If the get_next() invocation is simple, then style (1) is perfectly fine.

- Style (2) is the worst of all.

- If style (1) is not appropriate for whatever reason, then style (3) is 
frequently a good replacement. Style (3) is sometimes rejected by coding style 
documents though. Style (3) is not usable if is_valid() is a function-like 
macro that does not evaluate its argument exactly once. Frequently, is_valid() 
is simply open-coded with C operators (using extra parens), for example:

while ((cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command {

or more verbosely

while ((cmd = virtqueue_pop(vq, sizeof(struct virtio_gpu_ctrl_command))) !=
   NULL) {

If we really dislike style (1), then I'd propose style (3). I think the present 
patch (style (2)) is a step back.

Just my opinion of course; I don't feel too strongly about this.

Laszlo

[PATCH v2 1/2] target/arm: Pass the entire mte descriptor to mte_check_fail

We need more information than just the mmu_idx in order
to create the proper exception syndrome.  Only change the
function signature so far.

Signed-off-by: Richard Henderson 
---
 target/arm/mte_helper.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
index 104752041f..a40454588d 100644
--- a/target/arm/mte_helper.c
+++ b/target/arm/mte_helper.c
@@ -514,9 +514,10 @@ void HELPER(stzgm_tags)(CPUARMState *env, uint64_t ptr, 
uint64_t val)
 }
 
 /* Record a tag check failure.  */
-static void mte_check_fail(CPUARMState *env, int mmu_idx,
+static void mte_check_fail(CPUARMState *env, uint32_t desc,
uint64_t dirty_ptr, uintptr_t ra)
 {
+int mmu_idx = FIELD_EX32(desc, MTEDESC, MIDX);
 ARMMMUIdx arm_mmu_idx = core_to_aa64_mmu_idx(mmu_idx);
 int el, reg_el, tcf, select;
 uint64_t sctlr;
@@ -639,8 +640,7 @@ uint64_t mte_check1(CPUARMState *env, uint32_t desc,
 }
 
 if (unlikely(!mte_probe1_int(env, desc, ptr, ra, bit55))) {
-int mmu_idx = FIELD_EX32(desc, MTEDESC, MIDX);
-mte_check_fail(env, mmu_idx, ptr, ra);
+mte_check_fail(env, desc, ptr, ra);
 }
 
 return useronly_clean_ptr(ptr);
@@ -810,7 +810,7 @@ uint64_t mte_checkN(CPUARMState *env, uint32_t desc,
 
 fail_ofs = tag_first + n * TAG_GRANULE - ptr;
 fail_ofs = ROUND_UP(fail_ofs, esize);
-mte_check_fail(env, mmu_idx, ptr + fail_ofs, ra);
+mte_check_fail(env, desc, ptr + fail_ofs, ra);
 }
 
  done:
@@ -922,7 +922,7 @@ uint64_t HELPER(mte_check_zva)(CPUARMState *env, uint32_t 
desc, uint64_t ptr)
  fail:
 /* Locate the first nibble that differs. */
 i = ctz64(mem_tag ^ ptr_tag) >> 4;
-mte_check_fail(env, mmu_idx, align_ptr + i * TAG_GRANULE, ra);
+mte_check_fail(env, desc, align_ptr + i * TAG_GRANULE, ra);
 
  done:
 return useronly_clean_ptr(ptr);
-- 
2.25.1

[PATCH v2 0/2] target/arm: Fix syndrome for MTE tag check fail

Supercedes: <20200812171946.2044791-1-richard.hender...@linaro.org>

We missed filling in the WnR bit for the syndrome reported
into ESR_ELx for the Tag Check Fail Data Abort.


r~


Richard Henderson (2):
  target/arm: Pass the entire mte descriptor to mte_check_fail
  target/arm: Fill in the WnR syndrome bit in mte_check_fail

 target/arm/mte_helper.c | 19 ++-
 1 file changed, 10 insertions(+), 9 deletions(-)

-- 
2.25.1

[PATCH v2 2/2] target/arm: Fill in the WnR syndrome bit in mte_check_fail

According to AArch64.TagCheckFault, none of the other ISS values are
provided, so we do not need to go so far as merge_syn_data_abort.
But we were missing the WnR bit.

Tested-by: Andrey Konovalov 
Reported-by: Andrey Konovalov 
Signed-off-by: Richard Henderson 
---
 target/arm/mte_helper.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
index a40454588d..891306f5b0 100644
--- a/target/arm/mte_helper.c
+++ b/target/arm/mte_helper.c
@@ -519,7 +519,7 @@ static void mte_check_fail(CPUARMState *env, uint32_t desc,
 {
 int mmu_idx = FIELD_EX32(desc, MTEDESC, MIDX);
 ARMMMUIdx arm_mmu_idx = core_to_aa64_mmu_idx(mmu_idx);
-int el, reg_el, tcf, select;
+int el, reg_el, tcf, select, is_write, syn;
 uint64_t sctlr;
 
 reg_el = regime_el(env, arm_mmu_idx);
@@ -547,9 +547,10 @@ static void mte_check_fail(CPUARMState *env, uint32_t desc,
  */
 cpu_restore_state(env_cpu(env), ra, true);
 env->exception.vaddress = dirty_ptr;
-raise_exception(env, EXCP_DATA_ABORT,
-syn_data_abort_no_iss(el != 0, 0, 0, 0, 0, 0, 0x11),
-exception_target_el(env));
+
+is_write = FIELD_EX32(desc, MTEDESC, WRITE);
+syn = syn_data_abort_no_iss(el != 0, 0, 0, 0, 0, is_write, 0x11);
+raise_exception(env, EXCP_DATA_ABORT, syn, exception_target_el(env));
 /* noreturn, but fall through to the assert anyway */
 
 case 0:
-- 
2.25.1

[PATCH v2 2/3] target/arm: Implement an IMPDEF pauth algorithm

Without hardware acceleration, a cryptographically strong
algorithm is too expensive for pauth_computepac.

Even with hardware accel, we are not currently expecting
to link the linux-user binaries to any crypto libraries,
and doing so would generally make the --static build fail.

So choose XXH64 as a reasonably quick and decent hash.

Signed-off-by: Richard Henderson 
---
v2: Move the XXH64 bits to xxhash.h (ajb).
Create isar_feature_aa64_pauth_arch and fixup a comment
in isar_feature_aa64_pauth that no longer applies.
---
 include/qemu/xxhash.h | 82 +++
 target/arm/cpu.h  | 15 +--
 target/arm/pauth_helper.c | 41 +---
 3 files changed, 129 insertions(+), 9 deletions(-)

diff --git a/include/qemu/xxhash.h b/include/qemu/xxhash.h
index 076f1f6054..93ba1a0425 100644
--- a/include/qemu/xxhash.h
+++ b/include/qemu/xxhash.h
@@ -119,4 +119,86 @@ static inline uint32_t qemu_xxhash6(uint64_t ab, uint64_t 
cd, uint32_t e,
 return qemu_xxhash7(ab, cd, e, f, 0);
 }
 
+/*
+ * Component parts of the XXH64 algorithm from
+ * https://github.com/Cyan4973/xxHash/blob/v0.8.0/xxhash.h
+ *
+ * The complete algorithm looks like
+ *
+ *  i = 0;
+ *  if (len >= 32) {
+ *  v1 = seed + PRIME64_1 + PRIME64_2;
+ *  v2 = seed + PRIME64_2;
+ *  v3 = seed + 0;
+ *  v4 = seed - XXH_PRIME64_1;
+ *  do {
+ *  v1 = XXH64_round(v1, get64bits(input + i));
+ *  v2 = XXH64_round(v2, get64bits(input + i + 8));
+ *  v3 = XXH64_round(v3, get64bits(input + i + 16));
+ *  v4 = XXH64_round(v4, get64bits(input + i + 24));
+ *  } while ((i += 32) <= len);
+ *  h64 = XXH64_mergerounds(v1, v2, v3, v4);
+ *  } else {
+ *  h64 = seed + PRIME64_5;
+ *  }
+ *  h64 += len;
+ *
+ *  for (; i + 8 <= len; i += 8) {
+ *  h64 ^= XXH64_round(0, get64bits(input + i));
+ *  h64 = rol64(h64, 27) * PRIME64_1 + PRIME64_4;
+ *  }
+ *  for (; i + 4 <= len; i += 4) {
+ *  h64 ^= get32bits(input + i) * PRIME64_1;
+ *  h64 = rol64(h64, 23) * PRIME64_2 + PRIME64_3;
+ *  }
+ *  for (; i < len; i += 1) {
+ *  h64 ^= get8bits(input + i) * PRIME64_5;
+ *  h64 = rol64(h64, 11) * PRIME64_1;
+ *  }
+ *
+ *  return XXH64_avalanche(h64)
+ *
+ * Exposing the pieces instead allows for simplified usage when
+ * the length is a known constant and the inputs are in registers.
+ */
+#define PRIME64_1   0x9E3779B185EBCA87ULL
+#define PRIME64_2   0xC2B2AE3D27D4EB4FULL
+#define PRIME64_3   0x165667B19E3779F9ULL
+#define PRIME64_4   0x85EBCA77C2B2AE63ULL
+#define PRIME64_5   0x27D4EB2F165667C5ULL
+
+static inline uint64_t XXH64_round(uint64_t acc, uint64_t input)
+{
+return rol64(acc + input * PRIME64_2, 31) * PRIME64_1;
+}
+
+static inline uint64_t XXH64_mergeround(uint64_t acc, uint64_t val)
+{
+return (acc ^ XXH64_round(0, val)) * PRIME64_1 + PRIME64_4;
+}
+
+static inline uint64_t XXH64_mergerounds(uint64_t v1, uint64_t v2,
+ uint64_t v3, uint64_t v4)
+{
+uint64_t h64;
+
+h64 = rol64(v1, 1) + rol64(v2, 7) + rol64(v3, 12) + rol64(v4, 18);
+h64 = XXH64_mergeround(h64, v1);
+h64 = XXH64_mergeround(h64, v2);
+h64 = XXH64_mergeround(h64, v3);
+h64 = XXH64_mergeround(h64, v4);
+
+return h64;
+}
+
+static inline uint64_t XXH64_avalanche(uint64_t h64)
+{
+h64 ^= h64 >> 33;
+h64 *= PRIME64_2;
+h64 ^= h64 >> 29;
+h64 *= PRIME64_3;
+h64 ^= h64 >> 32;
+return h64;
+}
+
 #endif /* QEMU_XXHASH_H */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 44901923c8..776bf30cbc 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3767,10 +3767,8 @@ static inline bool isar_feature_aa64_fcma(const 
ARMISARegisters *id)
 static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id)
 {
 /*
- * Note that while QEMU will only implement the architected algorithm
- * QARMA, and thus APA+GPA, the host cpu for kvm may use implementation
- * defined algorithms, and thus API+GPI, and this predicate controls
- * migration of the 128-bit keys.
+ * Return true if any form of pauth is enabled, as this
+ * predicate controls migration of the 128-bit keys.
  */
 return (id->id_aa64isar1 &
 (FIELD_DP64(0, ID_AA64ISAR1, APA, 0xf) |
@@ -3779,6 +3777,15 @@ static inline bool isar_feature_aa64_pauth(const 
ARMISARegisters *id)
  FIELD_DP64(0, ID_AA64ISAR1, GPI, 0xf))) != 0;
 }
 
+static inline bool isar_feature_aa64_pauth_arch(const ARMISARegisters *id)
+{
+/*
+ * Return true if pauth is enabled with the architected QARMA algorithm.
+ * QEMU will always set APA+GPA to the same value.
+ */
+return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, APA) != 0;
+}
+
 static inline bool isar_feature_aa64_sb(const ARMISARegisters *id)
 {
 return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, SB) != 0;
diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
index

[PATCH v2 1/3] target/arm: Add cpu properties to control pauth

The crypto overhead of emulating pauth can be significant for
some workloads.  Add two boolean properties that allows the
feature to be turned off, on with the architected algorithm,
or on with an implementation defined algorithm.

We need two intermediate booleans to control the state while
parsing properties lest we clobber ID_AA64ISAR1 into an invalid
intermediate state.

Signed-off-by: Richard Henderson 
---
v2: Use boolean properties instead of an enum (drjones).
---
 target/arm/cpu.h | 10 ++
 target/arm/cpu.c | 13 +
 target/arm/cpu64.c   | 40 
 target/arm/monitor.c |  1 +
 4 files changed, 60 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 9e8ed423ea..44901923c8 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -196,9 +196,11 @@ typedef struct {
 #ifdef TARGET_AARCH64
 # define ARM_MAX_VQ16
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
 #else
 # define ARM_MAX_VQ1
 static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
+static inline void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) { }
 #endif
 
 typedef struct ARMVectorReg {
@@ -938,6 +940,14 @@ struct ARMCPU {
 uint64_t reset_cbar;
 uint32_t reset_auxcr;
 bool reset_hivecs;
+
+/*
+ * Intermediate values used during property parsing.
+ * Once finalized, the values should be read from ID_AA64ISAR1.
+ */
+bool prop_pauth;
+bool prop_pauth_impdef;
+
 /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
 uint32_t dcz_blocksize;
 uint64_t rvbar;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 111579554f..c719562d3d 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1307,6 +1307,19 @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
 error_propagate(errp, local_err);
 return;
 }
+
+/*
+ * KVM does not support modifications to this feature.
+ * We have not registered the cpu properties when KVM
+ * is in use, so the user will not be able to set them.
+ */
+if (!kvm_enabled()) {
+arm_cpu_pauth_finalize(cpu, _err);
+if (local_err != NULL) {
+error_propagate(errp, local_err);
+return;
+}
+}
 }
 }
 
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index dd696183df..0227862d39 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -28,6 +28,8 @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "qapi/visitor.h"
+#include "hw/qdev-properties.h"
+
 
 #ifndef CONFIG_USER_ONLY
 static uint64_t a57_a53_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -572,6 +574,36 @@ void aarch64_add_sve_properties(Object *obj)
 }
 }
 
+void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
+{
+int arch_val = 0, impdef_val = 0;
+uint64_t t;
+
+/* TODO: Handle HaveEnhancedPAC, HaveEnhancedPAC2, HaveFPAC. */
+if (cpu->prop_pauth) {
+if (cpu->prop_pauth_impdef) {
+impdef_val = 1;
+} else {
+arch_val = 1;
+}
+} else if (cpu->prop_pauth_impdef) {
+error_setg(errp, "cannot enable pauth-impdef without pauth");
+error_append_hint(errp, "Add pauth=on to the CPU property list.\n");
+}
+
+t = cpu->isar.id_aa64isar1;
+t = FIELD_DP64(t, ID_AA64ISAR1, APA, arch_val);
+t = FIELD_DP64(t, ID_AA64ISAR1, GPA, arch_val);
+t = FIELD_DP64(t, ID_AA64ISAR1, API, impdef_val);
+t = FIELD_DP64(t, ID_AA64ISAR1, GPI, impdef_val);
+cpu->isar.id_aa64isar1 = t;
+}
+
+static Property arm_cpu_pauth_property =
+DEFINE_PROP_BOOL("pauth", ARMCPU, prop_pauth, true);
+static Property arm_cpu_pauth_impdef_property =
+DEFINE_PROP_BOOL("pauth-impdef", ARMCPU, prop_pauth_impdef, false);
+
 /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
  * otherwise, a CPU with as many features enabled as our emulation supports.
  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -627,10 +659,6 @@ static void aarch64_max_initfn(Object *obj)
 t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);
 t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 1);
 t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);
-t = FIELD_DP64(t, ID_AA64ISAR1, APA, 1); /* PAuth, architected only */
-t = FIELD_DP64(t, ID_AA64ISAR1, API, 0);
-t = FIELD_DP64(t, ID_AA64ISAR1, GPA, 1);
-t = FIELD_DP64(t, ID_AA64ISAR1, GPI, 0);
 t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
 t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
 t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
@@ -718,6 +746,10 @@ static void aarch64_max_initfn(Object *obj)
 cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache 
*/
 cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
+
+/* Default to

[PATCH v2 0/3] target/arm: Implement an IMPDEF pauth algorithm

The architected pauth algorithm is quite slow without
hardware support, and boot times for kernels that enable
use of the feature have been significantly impacted.

Version 1 blurb at
  https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg02172.html
which contains larger study of the tradeoffs.

Version 2 changes:
  * Use boolean properties, for qmp_query_cpu_model_expansion (drjones).
  * Move XXH64 implementation to xxhash.h (ajb).
  * Include a small cleanup to parsing the "sve" property
that I noticed along the way.


r~


Richard Henderson (3):
  target/arm: Add cpu properties to control pauth
  target/arm: Implement an IMPDEF pauth algorithm
  target/arm: Use object_property_add_bool for "sve" property

 include/qemu/xxhash.h | 82 +++
 target/arm/cpu.h  | 25 ++--
 target/arm/cpu.c  | 13 +++
 target/arm/cpu64.c| 64 +-
 target/arm/monitor.c  |  1 +
 target/arm/pauth_helper.c | 41 +---
 6 files changed, 199 insertions(+), 27 deletions(-)

-- 
2.25.1

[PATCH v2 3/3] target/arm: Use object_property_add_bool for "sve" property

The interface for object_property_add_bool is simpler,
making the code easier to understand.

Signed-off-by: Richard Henderson 
---
 target/arm/cpu64.c | 24 ++--
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 0227862d39..cce0da0b90 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -488,6 +488,12 @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor 
*v, const char *name,
 cpu->sve_max_vq = max_vq;
 }
 
+/*
+ * Note that cpu_arm_get/set_sve_vq cannot use the simpler
+ * object_property_add_bool interface because they make use
+ * of the contents of "name" to determine which bit on which
+ * to operate.
+ */
 static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
void *opaque, Error **errp)
 {
@@ -529,26 +535,17 @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, 
const char *name,
 set_bit(vq - 1, cpu->sve_vq_init);
 }
 
-static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
-void *opaque, Error **errp)
+static bool cpu_arm_get_sve(Object *obj, Error **errp)
 {
 ARMCPU *cpu = ARM_CPU(obj);
-bool value = cpu_isar_feature(aa64_sve, cpu);
-
-visit_type_bool(v, name, , errp);
+return cpu_isar_feature(aa64_sve, cpu);
 }
 
-static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
-void *opaque, Error **errp)
+static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
 {
 ARMCPU *cpu = ARM_CPU(obj);
-bool value;
 uint64_t t;
 
-if (!visit_type_bool(v, name, , errp)) {
-return;
-}
-
 if (value && kvm_enabled() && !kvm_arm_sve_supported()) {
 error_setg(errp, "'sve' feature not supported by KVM on this host");
 return;
@@ -563,8 +560,7 @@ void aarch64_add_sve_properties(Object *obj)
 {
 uint32_t vq;
 
-object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
-cpu_arm_set_sve, NULL, NULL);
+object_property_add_bool(obj, "sve", cpu_arm_get_sve, cpu_arm_set_sve);
 
 for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 char name[8];
-- 
2.25.1

Re: [PATCH 01/14] spapr: Simplify error handling in spapr_phb_realize()

2020-08-13 Thread Daniel Henrique Barboza


Greg,

This patch is breaking guest startup in ppc-for-5.2 for me. The process
gives an almost instant segfault. Here's what I'm doing:

$ sudo ./qemu-system-ppc64 -machine 
pseries-5.1,accel=kvm,usb=off,dump-guest-core=off -m 65536\
-overcommit mem-lock=off -smp 4,sockets=4,cores=1,threads=1 -rtc base=utc 
-display none -vga none -nographic -boot menu=on \
-device spapr-pci-host-bridge,index=1,id=pci.1 -device 
spapr-pci-host-bridge,index=2,id=pci.2 \
-device spapr-pci-host-bridge,index=3,id=pci.3 -device 
spapr-pci-host-bridge,index=4,id=pci.4 \
-device qemu-xhci,id=usb,bus=pci.0,addr=0x2 \
-drive file=/home/danielhb/f32.qcow2,format=qcow2,if=none,id=drive-virtio-disk0 
\
-device 
virtio-blk-pci,scsi=off,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1
 \
-device usb-kbd,id=input0,bus=usb.0,port=1 -device 
usb-mouse,id=input1,bus=usb.0,port=2 \
-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x4 -msg timestamp=on \
-machine cap-ccf-assist=off
Segmentation fault
$


GDB points this backtrace:

Thread 1 "qemu-system-ppc" received signal SIGSEGV, Segmentation fault.
error_vprepend (errp=0x7fffe400, fmt=0x100ec2698 "can't allocate LSIs: ", 
ap=0x7fffe290 "\030") at /home/danielhb/qemu/util/error.c:134
134 g_string_append(newmsg, (*errp)->msg);
Missing separate debuginfos, use: dnf debuginfo-install 
glib2-2.64.4-1.fc32.ppc64le libblkid-2.35.2-1.fc32.ppc64le 
libffi-3.1-24.fc32.ppc64le libgcrypt-1.8.5-3.fc32.ppc64le 
libgpg-error-1.36-3.fc32.ppc64le libmount-2.35.2-1.fc32.ppc64le 
libselinux-3.0-5.fc32.ppc64le libxml2-2.9.10-3.fc32.ppc64le 
ncurses-libs-6.1-15.20191109.fc32.ppc64le numactl-libs-2.0.12-4.fc32.ppc64le 
pcre-8.44-1.fc32.ppc64le pcre2-10.35-4.fc32.ppc64le 
pixman-0.40.0-1.fc32.ppc64le xz-libs-5.2.5-1.fc32.ppc64le 
zlib-1.2.11-21.fc32.ppc64le
(gdb) bt
#0  error_vprepend (errp=0x7fffe400, fmt=0x100ec2698 "can't allocate LSIs: ", 
ap=0x7fffe290 "\030") at /home/danielhb/qemu/util/error.c:134
#1  0x000100c1e9cc in error_prepend (errp=0x7fffe400, fmt=0x100ec2698 "can't 
allocate LSIs: ") at /home/danielhb/qemu/util/error.c:144
#2  0x0001004cdad4 in spapr_phb_realize (dev=0x101d6cb90, 
errp=0x7fffe400) at /home/danielhb/qemu/hw/ppc/spapr_pci.c:1982
#3  0x000100735f70 in device_set_realized (obj=0x101d6cb90, value=true, 
errp=0x7fffe568) at /home/danielhb/qemu/hw/core/qdev.c:864
#4  0x000100a5aae4 in property_set_bool (obj=0x101d6cb90, v=0x101d6daa0, 
name=0x100f13df8 "realized", opaque=0x1016d2430, errp=0x7fffe568) at 
/home/danielhb/qemu/qom/object.c:2202
#5  0x000100a57d64 in object_property_set (obj=0x101d6cb90, name=0x100f13df8 
"realized", v=0x101d6daa0, errp=0x1016156c0 ) at 
/home/danielhb/qemu/qom/object.c:1349
#6  0x000100a5cb38 in object_property_set_qobject (obj=0x101d6cb90, name=0x100f13df8 
"realized", value=0x101d6c950, errp=0x1016156c0 )
at /home/danielhb/qemu/qom/qom-qobject.c:28
#7  0x000100a581fc in object_property_set_bool (obj=0x101d6cb90, name=0x100f13df8 
"realized", value=true, errp=0x1016156c0 ) at 
/home/danielhb/qemu/qom/object.c:1416
#8  0x000100734178 in qdev_realize (dev=0x101d6cb90, bus=0x10198e250, 
errp=0x1016156c0 ) at /home/danielhb/qemu/hw/core/qdev.c:379
#9  0x0001007341dc in qdev_realize_and_unref (dev=0x101d6cb90, bus=0x10198e250, 
errp=0x1016156c0 ) at /home/danielhb/qemu/hw/core/qdev.c:386
#10 0x0001007463c0 in sysbus_realize_and_unref (dev=0x101d6cb90, errp=0x1016156c0 
) at /home/danielhb/qemu/hw/core/sysbus.c:260
#11 0x0001004a6960 in spapr_create_default_phb () at 
/home/danielhb/qemu/hw/ppc/spapr.c:2652
#12 0x0001004a7428 in spapr_machine_init (machine=0x101965800) at 
/home/danielhb/qemu/hw/ppc/spapr.c:2940
#13 0x00010074a3b0 in machine_run_board_init (machine=0x101965800) at 
/home/danielhb/qemu/hw/core/machine.c:1135
#14 0x00010054f390 in qemu_init (argc=42, argv=0x70a8, 
envp=0x7200) at /home/danielhb/qemu/softmmu/vl.c:4355
#15 0x000100b8ee00 in main (argc=42, argv=0x70a8, 
envp=0x7200) at /home/danielhb/qemu/softmmu/main.c:48
(gdb)


Removing this patch (i.e. resetting HEAD at "target/ppc: Integrate icount
to purr, vtb, and tbu40") allows me to get the guest rolling.



Thanks,


Daniel



On 8/10/20 1:53 PM, Greg Kurz wrote:

The spapr_phb_realize() function has a local_err variable which
is used to:

1) check failures of spapr_irq_findone() and spapr_irq_claim()

2) prepend extra information to the error message

Recent work from Markus Armbruster highlighted we get better
code when testing the return value of a function, rather than
setting up all the local_err boiler plate. For similar reasons,
it is now preferred to use ERRP_GUARD() and error_prepend()
rather than error_propagate_prepend().

Since spapr_irq_findone() and spapr_irq_claim() return negative
values in case of failure, do both changes.

This is just cleanup, no functional impact.

Signed-off-by: Greg Kurz 
Reviewed-by:

Re: [RFC PATCH v2 2/3] target/mips/op_helper: Document Invalidate/Writeback opcodes as no-op

On 8/13/20 11:15 AM, Philippe Mathieu-Daudé wrote:
>  switch (cache_operation) {
> -case 0b010:
> -/* Index Store Tag */
> +case 0b010: /* Index Store Tag */
>  memory_region_dispatch_write(env->itc_tag, index, env->CP0_TagLo,
>   MO_64, MEMTXATTRS_UNSPECIFIED);
>  break;
> -case 0b001:
> -/* Index Load Tag */
> +case 0b001: /* Index Load Tag */
>  memory_region_dispatch_read(env->itc_tag, index, >CP0_TagLo,
>  MO_64, MEMTXATTRS_UNSPECIFIED);
>  break;

Merge these lines back to patch 1.  With that, both 1/ and 2/,

Reviewed-by: Richard Henderson 

r~

Re: [RFC PATCH v2 3/3] target/mips/op_helper: Log unimplemented cache opcode

On 8/13/20 11:15 AM, Philippe Mathieu-Daudé wrote:
>  #ifndef CONFIG_USER_ONLY
> +static const char *type_name[] = {

const char * const

Otherwise,
Reviewed-by: Richard Henderson 

r~

Re: [PATCH] docs/system/target-avr: Improve the AVR docs and add to MAINTAINERS

2020-08-13 Thread Michael Rolnik

Reviewed-by: Michael Rolnik 

On Thu, Aug 13, 2020 at 7:50 PM Richard Henderson <
richard.hender...@linaro.org> wrote:

> On 8/12/20 8:53 AM, Thomas Huth wrote:
> > The examples look nicer when using "::" code blocks.
> > Also mention that "-d in_asm" only outputs instructions that have not
> > been translated by the JIT layer yet.
> > And while we're at it, also add the AVR doc file to the MAINTAINERS file.
> >
> > Signed-off-by: Thomas Huth 
> > ---
> >  MAINTAINERS|  1 +
> >  docs/system/target-avr.rst | 47 +++---
> >  2 files changed, 30 insertions(+), 18 deletions(-)
>
> Reviewed-by: Richard Henderson 
>
> r~
>


-- 
Best Regards,
Michael Rolnik

[Bug 1890775] Re: Aten USB to Serial bridge does not work with qemu under Windows 10

2020-08-13 Thread Laci

Hi again,

Seems to be there is no solution for my problem :(
I have succeeded create NTVDMx64 patch on my Windows 10 installation, so i can 
run directly 16 bit ms dos applications without any dos emulator.
I take the initiative to close the bug.

Bye

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1890775

Title:
  Aten USB to Serial bridge does not work with qemu under Windows 10

Status in QEMU:
  New

Bug description:
  I would like to use MSDOS 6.22 with qemu (unfortunatelly lot of our test 
programs has been written in dos).
  I tried to connect two laptop by RS232 port, one of the machine have a 
built-in serial port and run with native MSDOS 6.22 with 4.0 norton commander. 
Another machine have only USB ports and i try to use a new Aten USB to Serial 
device. Ok. Has been started qemu with -serial and -chardev parameters, at 
startup appear a window with serial port setting such as baud rate, start bit, 
etc...

  Quemu has been satrted succeeded but serial port cannot be used
  becouse was nothing activited on usb serial adapter :(

  I tried same configuration with VirtualBox and everything was worked
  fine (serial connection was estabiled and copied several files from
  one machine into another machine), seems to be the emulated serial
  port has been worked fine.

  I would like to use qemu, i just thougt qemu is better, simple and
  faster...

  Exists solution or is this a qemu bug?

  Thank you!

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1890775/+subscriptions

[Bug 1815911] Re: aptitude crashes qemu-m68k with handle_cpu_signal received signal outside vCPU context

2020-08-13 Thread Thomas Huth

** Changed in: qemu
   Status: Incomplete => Fix Released

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1815911

Title:
  aptitude crashes qemu-m68k with handle_cpu_signal received signal
  outside vCPU context

Status in QEMU:
  Fix Released

Bug description:
  When building a package with sbuild on Debian, sbuild can use aptitude
  to resolve dependencies.

  Recently, some changes introduced to aptitude or related packages
  cause qemu to crash:

  (sid-m68k-sbuild)root@nofan:/# aptitude -y --without-recommends -o 
Dpkg::Options::=--force-confold -o 
Aptitude::CmdLine::Ignore-Trust-Violations=false -o 
Aptitude::ProblemResolver::StepScore=100 -o 
Aptitude::ProblemResolver::SolutionCost="safety, priority, 
non-default-versions" -o Aptitude::ProblemResolver::Hints::KeepDummy="reject 
sbuild-build-depends-core-dummy :UNINST" -o 
Aptitude::ProblemResolver::Keep-All-Level=55000 -o 
Aptitude::ProblemResolver::Remove-Essential-Level=maximum install vim
  Warning: Invalid locale (please review locale settings, this might lead to 
problems later):
locale::facet::_S_create_c_locale name not valid
  The following NEW packages will be installed:
libgpm2{a} vim vim-common{a} vim-runtime{a} xxd{a} 
  0 packages upgraded, 5 newly installed, 0 to remove and 1 not upgraded.
  Need to get 7225 kB/7260 kB of archives. After unpacking 33.5 MB will be used.
  qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x6019d1bf
  qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x601b64ab
  Segmentation fault
  (sid-m68k-sbuild)root@nofan:/#

  The crash does not reproduce on real hardware running Debian unstable.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1815911/+subscriptions

Re: [PATCH 07/11] vfio/platform: Remove dead assignment in vfio_intp_interrupt()

2020-08-13 Thread Auger Eric

Hi Alex,

On 8/13/20 9:15 PM, Alex Williamson wrote:
> On Thu, 13 Aug 2020 20:02:45 +0200
> Auger Eric  wrote:
> 
>> Hi Alex,
>>
>> On 8/13/20 6:59 PM, Alex Williamson wrote:
>>> On Thu, 13 Aug 2020 15:37:08 +0800
>>> Chen Qun  wrote:
>>>   
 Clang static code analyzer show warning:
 hw/vfio/platform.c:239:9: warning: Value stored to 'ret' is never read
 ret = event_notifier_test_and_clear(intp->interrupt);
 ^ ~~

 Reported-by: Euler Robot 
 Signed-off-by: Chen Qun 
 ---
 Cc: Alex Williamson 
 Cc: Eric Auger 
 ---
  hw/vfio/platform.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
 index ac2cefc9b1..869ed2c39d 100644
 --- a/hw/vfio/platform.c
 +++ b/hw/vfio/platform.c
 @@ -236,7 +236,7 @@ static void vfio_intp_interrupt(VFIOINTp *intp)
  trace_vfio_intp_interrupt_set_pending(intp->pin);
  QSIMPLEQ_INSERT_TAIL(>pending_intp_queue,
   intp, pqnext);
 -ret = event_notifier_test_and_clear(intp->interrupt);
 +event_notifier_test_and_clear(intp->interrupt);
  return;
  }  
>>>
>>> Testing that an event is pending in our notifier is generally a
>>> prerequisite to doing anything in the interrupt handler, I don't
>>> understand why we're just consuming it and ignoring the return value.
>>> The above is in the delayed handling branch of the function, but the
>>> normal non-delayed path would only go on to error_report() if the
>>> notifier is not pending and then inject an interrupt anyway.  This all
>>> seems rather suspicious and it's a unique pattern among the vfio
>>> callers of this function.  Is there a more fundamental bug that this
>>> function should perform this test once and return without doing
>>> anything if it's called spuriously, ie. without a notifier pending?
>>> Thanks,  
>>
>> Hum that's correct that other VFIO call sites do the check. My
>> understanding was that this could not fail in this case as, if we
>> entered the handler there was something to be cleared. In which
>> situation can this fail?
> 
> I'm not sure what the right answer is, I see examples either way
> looking outside of vfio code.  On one hand, maybe we never get called
> spuriously, on the other if it's the callee's responsibility to drain
> events from the fd and we have it readily accessible whether there were
> any events pending, why would we inject an interrupt if the result that
> we have in hand shows no pending events?  The overhead of returning
> based on that result is minuscule.

I agree
> 
> qemu_set_fd_handler() is a wrapper for aio_set_fd_handler().  Stefan is
> a possible defacto maintainer of some of the aio code.  Stefan, do you
> have thoughts on whether callbacks from event notifier fds should
> consider spurious events?  Thanks,

Indeed I saw that for instance block/nvme.c nvme_handle_event is not
checking the result.

Let's wait for Stefan's answer ...

Thanks

Eric
> 
> Alex
>

Re: [PATCH 07/11] vfio/platform: Remove dead assignment in vfio_intp_interrupt()